social-engineering

The skill is internally consistent, but its stated purpose is to help an AI agent conduct offensive social engineering campaigns, including phishing and credential harvesting. With no install or data-routing concerns visible, the main issue is the high-risk real-world abuse potential of the capability itself.

This fragment is an explicit, operational social-engineering/pretexting playbook with concrete scripts for credential and confidential-document elicitation and guidance for defeating out-of-band verification. While it is not executable code in the excerpt, its actionable nature makes it strongly harmful if shipped in a software artifact, indicating a high likelihood of malicious intent/facilitation rather than legitimate defensive functionality.

No executable malware is present; however, the fragment is an actionable vishing/voice-phishing playbook containing concrete example scripts and operational steps (VoIP/caller-ID spoofing, coercion, and recording). As a distributed supply-chain artifact, it poses a high misuse risk by directly enabling credential theft and financial/privileged-action fraud.

This fragment is a highly actionable, offense-oriented guide for cloning and replaying physical access badges to obtain door access and verify success via access control logs. While it is not a typical software dependency and cannot be assessed for embedded malware behavior, its content meaningfully enables credential forgery and unauthorized entry. No obfuscation is observed; the main risk is misuse of the operational instructions themselves.

No software/malware behavior is present because the fragment is instructional physical-security guidance, not code. However, it is highly actionable for evading badge-controlled access (tailgating/piggybacking with fake badge and scripted pretexts, plus evidence-collection guidance that includes recording sensitive access artifacts). Treat as high misuse risk content if included in or distributed with software supply-chain artifacts.

This fragment is explicitly malicious and highly actionable: it provides step-by-step guidance and concrete command examples for phishing/credential harvesting and for 2FA bypass via reverse-proxy tooling, including handling of session/cookie artifacts for authenticated validation. No obfuscation is present; the threat is the direct operational enablement of account compromise. In a supply-chain context, this content should be treated as a critical security concern and removed/blocked.

No executable malware code is present, but the fragment is highly actionable BEC/spearphishing enablement: it provides operational steps, domain impersonation methods (lookalike/IDN), explicit example templates requesting wire/payments/HR disclosures, and engagement-success criteria. As distributed software supply-chain content, it represents a high misuse risk by directly facilitating phishing/fraud tradecraft.

High-risk, directly actionable offensive content. It provides explicit instructions and payload templates for HID injection and PowerShell `IEX`/`DownloadString` remote code execution from attacker infrastructure, along with beacon/callback tracking and QR-based phishing lure deployment. Despite an ‘authorized assessment’ framing, the fragment matches real compromise tradecraft and would materially increase an adversary’s capability to execute and validate USB-bait-driven attacks.

The provided fragment is explicitly malicious/weaponized content for smishing: it describes sending phishing SMS messages via an external gateway and includes a tracking page skeleton that POSTs victim browser metadata to a server endpoint before redirecting to a “legitimate” site to reduce suspicion. It also explicitly targets credential capture as the end goal (though that specific form is not present in the snippet). This should be treated as extremely high-risk and inappropriate for any benign dependency or supply-chain artifact.

No actual dependency code was provided; the artifact is an attack playbook describing phishing/watering-hole drive-by compromise and credential/endpoint capture. No concrete code-level sources, sinks, or flows exist to analyze, but the content itself is strongly consistent with malicious misuse (third-party compromise, injected capture scripting, and session/browser fingerprinting).