performing-phishing-simulation-with-gophish

SUSPICIOUS. The install source itself appears legitimate and proportionate for GoPhish, so supply-chain risk is limited. However, the skill’s primary function is to give an AI agent offensive phishing-simulation capability, including credential capture and email delivery, which creates high real-world abuse potential even if framed as authorized testing.

The code is a GoPhish administration and phishing-awareness simulation utility with legitimate defensive use, but it has inherently sensitive capabilities including sending campaigns and capturing submitted credentials. No clear malware, covert exfiltration, persistence, obfuscation, or hardcoded malicious endpoint is present. The primary security concerns are intentional phishing functionality, optional SSL verification bypass, API-key exposure risk, unescaped HTML report data, and apparent syntax/undefined-variable defects. Use only against authorized targets and correct the report-generation errors and HTML escaping before deployment.