The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a utility script scripts/agent.py designed to be executed via command line to interact with a GoPhish server. The script initializes the API client with SSL verification disabled (verify=False), which is documented as being for lab environments but should be noted as a security practice violation for production use.\n- [INDIRECT_PROMPT_INJECTION]: The script scripts/agent.py ingests data from a user-provided CSV file in the import_targets_from_csv function, creating a surface for potential injection if the data is subsequently processed by an agent.\n
Ingestion points: The script reads targets from a file path provided via the --targets-csv argument.\n
Boundary markers: No explicit delimiters or instructions are used to isolate CSV data from the agent's logic.\n
Capability inventory: The skill can perform network operations via the GoPhish API, read files, and write campaign results to local JSON reports.\n
Sanitization: No explicit validation or sanitization of CSV fields (first_name, last_name, email, position) is performed before transmission to the API.\n- [EXTERNAL_DOWNLOADS]: The instructions recommend installing the gophish and requests packages via pip. These are well-known, legitimate libraries used for interacting with the GoPhish API and making HTTP requests.

performing-red-team-phishing-with-gophish