Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Liberty91LTD/cti-skills --skill phishing-social-engineeringgit clone --depth 1 https://github.com/Liberty91LTD/cti-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liberty91ltd/cti-skills/phishing-social-engineering)<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/phishing-social-engineering"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/phishing-social-engineering/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/phishing-social-engineering"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/phishing-social-engineering.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.02822 |
| Opus 5 | $0.00028 | $0.01411 |
| Sonnet 5 | $0.00011 | $0.00564 |
| Haiku 4.5 | $0.00006 | $0.00282 |
Grade A, and why
phishing-social-engineering scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Phishing & Social Engineering
Executive Summary
Phishing and social engineering remain the most common initial access vectors across both cybercriminal and state-sponsored operations. The landscape has undergone significant evolution beyond traditional email-based credential harvesting. Adversary-in-the-Middle (AitM) phishing platforms — notably EvilProxy and Evilginx — now enable real-time interception of credentials AND session tokens, effectively bypassing most forms of multi-factor authentication (MFA). This development has fundamentally altered the threat model for organizations relying on MFA as a primary defense, shifting the security boundary toward phishing-resistant MFA methods such as FIDO2/WebAuthn hardware keys.
The Phishing-as-a-Service (PhaaS) market has matured substantially, with platforms like EvilProxy, Greatness, Tycoon 2FA, and others offering turnkey AitM phishing kits with subscription models, customer support, and real-time dashboards. These services target Microsoft 365 accounts disproportionately, reflecting the platform's dominance in enterprise environments. Pricing ranges from $200-$1,000+ per month depending on features and target capabilities. Meanwhile, Business Email Compromise (BEC) continues to generate the highest financial losses of any cybercrime category according to FBI IC3 data — over $2.9 billion in reported losses in 2023 alone — despite being less technically sophisticated than other threats.
Emerging vectors include QR code phishing ("quishing"), which evades email security gateways by embedding malicious URLs in images; vishing and callback phishing campaigns that move victims to phone conversations to bypass email controls; AI-generated deepfake voice and video for executive impersonation; and consent phishing that abuses OAuth application permissions to gain persistent access to cloud mailboxes. The combination of AI-enhanced content generation (eliminating grammatical tells), sophisticated infrastructure (legitimate cloud hosting, CAPTCHA protection, geofencing), and AitM session hijacking has made modern phishing significantly harder to detect and defend against.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 125 lines · 55 tokens per session scan A b8807dc30fb6
phishing-social-engineering is a skill published in the GitHub repository Liberty91LTD/cti-skills (18 stars, last pushed 1mo ago), licensed MIT. It adds 55 tokens to every session and 2,822 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ai-ad-copy-compliance-review
A risk-review assistant for advertising and sales copy. It examines provided material for possible concerns and suggests actions.
ai-agent-browser
A business-diagnosis assistant for marketing, operations, product, and sales questions. It breaks down a goal and produces a summary, findings, action suggestions, and reusable deliverables.
ai-article
A Chinese-language assistant for turning source material into article and content-operation deliverables. It is aimed at creators, marketers, technical teams, and media publishers.
ai-brand-voice-review
A business-diagnosis assistant for marketing, operations, services, and sales questions.
ai-browser-use
A business-diagnosis assistant for marketing, operations, product, and sales questions about how to approach a task.
ai-content-material-audit
A Chinese-language copy-review assistant for creators, marketers, operators, and media teams.