Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/akashrpatil/awesome-offensive-security-skillsnpx agentmods add skills/akashrpatil/awesome-offensive-security-skills/phishing-and-social-engineering-campaignsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/phishing-and-social-engineering-campaigns)<a href="https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/phishing-and-social-engineering-campaigns"><img src="https://agentmods.dev/badge/skills/akashrpatil/awesome-offensive-security-skills/phishing-and-social-engineering-campaigns/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/phishing-and-social-engineering-campaigns"><img src="https://agentmods.dev/badge/skills/akashrpatil/awesome-offensive-security-skills/phishing-and-social-engineering-campaigns.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.02336 |
| Opus 5 | $0.00039 | $0.01168 |
| Sonnet 5 | $0.00015 | $0.00467 |
| Haiku 4.5 | $0.00008 | $0.00234 |
Grade A, and why
phishing-and-social-engineering-campaigns scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo certbot certonly --standalone -d phish-domain.com Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
# wget -r -l 1 https://target.com/login How it starts
The opening of the file, as written. The whole thing — 285 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Phishing & Social Engineering Campaigns
When to Use
- During authorized red team engagements to test human security awareness
- When simulating APT initial access vectors for organizations
- When assessing email security controls (SPF, DKIM, DMARC, email gateways)
- When measuring organization's phishing susceptibility baseline
- When testing security awareness training effectiveness
⚠️ CRITICAL: NEVER execute social engineering attacks without explicit written authorization (Rules of Engagement). All attacks must be scoped, time-bound, and approved by organizational leadership.
Prerequisites
- Authorized scope and rules of engagement for the target environment
- Appropriate tools installed on the attack/analysis platform
- Understanding of the target technology stack and architecture
- Documentation template ready for findings and evidence capture
Workflow
Phase 1: OSINT & Target Profiling
# Gather intelligence on target organization
# LinkedIn enumeration
# - Employee names, roles, email format
# - Recent hires (more susceptible)
# - Organizational structure
# Email format discovery
# Test common patterns: first.last@, f.last@, first_last@
# Use hunter.io, phonebook.cz, or email-format.com
# Company intelligence
# - Recent news/events (pretexting material)
# - Technologies used (craft tech-specific pretexts)
# - Partner organizations (third-party pretexts)
# - Office locations (physical social engineering)
# Email validation
# Verify emails exist without sending
# Tools: verify-email, emailhippo, hunter.io verify
Phase 2: Infrastructure Setup
# GoPhish setup
docker pull gophish/gophish
docker run -d --name gophish -p 3333:3333 -p 8080:8080 gophish/gophish
# Access admin panel: https://localhost:3333
# Default creds: admin / <check docker logs>
# Domain setup for phishing
# 1. Register a look-alike domain (typosquatting)
# target.com → target-security.com, targetsupport.com
# 2. Configure DNS records:
# - A record → phishing server IP
# - MX record → phishing server
# - SPF record: v=spf1 ip4:YOUR_IP ~all
# - DKIM: Generate and add DKIM record
# - DMARC: v=DMARC1; p=none;
# 3. SSL certificate (Let's Encrypt)
sudo certbot certonly --standalone -d phish-domain.com
# Email sending setup
# Option 1: SMTP server (postfix)
# Option 2: Third-party email service
# Option 3: Office 365 compromised account (for bypass testing)
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 285 lines · 77 tokens per session scan A d5d9e9662eb7
phishing-and-social-engineering-campaigns is a skill published in the GitHub repository akashrpatil/awesome-offensive-security-skills (5 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 77 tokens to every session and 2,336 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
conducting-social-engineering-penetration-test
Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.
conducting-social-engineering-penetration-test
Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized…
conducting-social-engineering-pretext-call
Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.
conducting-social-engineering-pretext-call
Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.
analyzing-malicious-url-with-urlscan
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.
conducting-spearphishing-simulation-campaign
Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf.