Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/HermeticOrmus/LibreSecOps-Claude-CodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/hermeticormus/libresecops-claude-code/phishing-sim)<a href="https://agentmods.dev/commands/hermeticormus/libresecops-claude-code/phishing-sim"><img src="https://agentmods.dev/badge/commands/hermeticormus/libresecops-claude-code/phishing-sim/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/hermeticormus/libresecops-claude-code/phishing-sim"><img src="https://agentmods.dev/badge/commands/hermeticormus/libresecops-claude-code/phishing-sim.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.01068 |
| Opus 5.5 | $0.00011 | $0.00427 |
| Sonnet 5.5 | $0.00005 | $0.00214 |
| Haiku 4.5 | $0.00003 | $0.00107 |
Grade A, and why
phishing-sim scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/phishing-sim
Design a phishing awareness simulation exercise with realistic scenarios, difficulty progression, measurement criteria, and educational follow-up materials.
Trigger
Use when designing phishing awareness exercises for authorized organizational training. Appropriate for:
- Launching a new security awareness program
- Conducting regular phishing simulation campaigns
- Testing awareness after training delivery
- Measuring improvement over time
- Preparing for compliance audits requiring awareness testing
This is for authorized, educational exercises conducted by the organization's security team or authorized training provider. Never for actual phishing attacks.
Input
- Organization context: Industry, size, typical communication patterns
- Target audience: All employees, specific departments, executives, new hires
- Difficulty level: Beginner (obvious red flags), Intermediate (subtle but detectable), Advanced (sophisticated, targeted)
- Current baseline: Previous simulation results if available (click rate, report rate)
- Training objectives: What specific awareness to build (URL inspection, attachment caution, BEC recognition, etc.)
- Simulation platform (optional): GoPhish, KnowBe4, Proofpoint, Cofense, or custom
Process
-
Scenario design -- Create realistic phishing scenarios appropriate to the organization:
Beginner level (obvious red flags):
- Misspelled sender domain
- Generic greeting ("Dear User")
- Urgency with poor grammar
- Suspicious attachment name
- Obvious URL mismatch on hover
Intermediate level (requires attention):
- Plausible sender (IT department, HR, known vendor)
- Professional formatting
- Contextually relevant topic (password reset, benefits enrollment)
- Subtle URL differences (homograph attacks, subdomain tricks)
- No attachment, just a credential harvesting link
Advanced level (spear-phishing):
- Personalized with recipient's name, role, recent activities
- Mimics real organizational communication style
- References real projects, people, or events
- Legitimate-looking landing page
- BEC scenario (CFO requesting wire transfer, vendor invoice change)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed · +5 lines · +27 tokens per session 787dd7b095c8
- 1mo ago First seen · 118 lines · 0 tokens per session scan A f2b8007efbb7
phishing-sim is a command published in the GitHub repository HermeticOrmus/LibreSecOps-Claude-Code (4 stars, last pushed 9d ago), licensed MIT. It adds 27 tokens to every session and 1,068 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
ts-glossary
TS bilingual-courseware glossary mode — course terminology glossary.
learning-path
Get personalized learning recommendations based on your goals, experience level, and learning style.
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.
specify
Create or update the feature specification from a natural language feature description.
converge
Assess the current codebase against the feature's spec, plan, and tasks, then append any remaining unbuilt work as new tasks to tasks.md so implement can complete it.