performing-red-team-phishing-with-gophish

SUSPICIOUS. The install path shown is mostly consistent with the stated GoPhish automation purpose, and data appears intended for the official/self-hosted GoPhish API rather than a third-party interceptor. However, this skill gives an AI agent phishing and credential-capture capabilities with real-world consequences, disables TLS verification in its example, and references an unverifiable local automation script, so the overall risk is high even without clear evidence of malware.

The fragment is a GoPhish automation and reporting utility. It does not contain clear malware indicators such as obfuscation, hidden network destinations, reverse shells, persistence, cryptomining, or unauthorized system-data theft. However, it is security-sensitive because it supports phishing campaigns and credential capture, disables TLS certificate verification, accepts API keys on the command line, and writes target data to reports. Use only in an authorized security-awareness or penetration-testing environment and enable certificate verification.