Individual skill

social-eng-phishing

Run an authorized phishing / spear-phishing assessment that measures human-factor risk — pretext, delivery, landing page, and tracking — without harming staff or hoarding real data. Load after social-eng-methodology when the objective is email-based (click, credential submission, or report rate). Signals: "phishing test", "simulated phishing", "test click rate", "credential harvesting assessment", awareness-campaign objective.

skills/social-eng/social-eng-phishing/SKILL.md

Read pinned source

Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Instructions only
Last checked: Nov 11, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 27
Repository last updated: Oct 14, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
ai-security Repository topic
application-security Repository topic
blue-team Repository topic
bug-bounty Repository topic
claude-code Repository topic
codex Repository topic
detection-engineering Repository topic
gemini Repository topic
marketing Derived category
data Derived category
testing Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 3,834 bytes

Read excerpt


# Phishing assessment

## When it applies
The engagement authorizes an email human-factor test and you've cleared `social-eng-methodology`
(authorization, allowed pretext themes, target boundaries, no-harm line). The goal is a
*measurement* — click rate, credential-submission rate, and, most importantly, the **report rate**
— not to embarrass anyone.

## Why it works
Phishing exploits trust and context, not a software bug: a message that looks like it comes from a
trusted source, with a plausible reason to act now, gets clicks even from trained users. Measuring
that safely tells the client where awareness and technical controls (MFA, mail filtering, reporting
tooling) need to improve.