Guide · Agent skill
How to use the Offensive Phishing Campaigns agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-phishing skill is a Markdown playbook (a SKILL.md file) that gives an AI agent a structured methodology for phishing campaigns run as part of an authorized red team exercise. It covers the campaign lifecycle from infrastructure and DNS records through pretexts, payload choices and campaign monitoring. This guide explains what an agent skill is, how to install this one, how to ask for help with natural requests, and what you need in place before using it.
Offensive Phishing CampaignsSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Get the offensive-phishing skill ZIP from this page.
- 2Unzip into the skills folder. Extract it into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder for a project install.
- 3Or upload in the Claude apps. Go to Settings → Capabilities → Skills and upload the ZIP if you use the Claude apps.
- 4Confirm authorization and scope. Write down the signed scope, target lists and escalation contacts before asking for campaign help.
- 5Ask a specific question. Describe the stage you need, such as infrastructure setup or pretext development, in plain language.
- 6Verify each step. Check every command and record against your scope and your environment before running it.
What an agent skill is and what this one makes the agent do
An agent skill is a folder containing a SKILL.md file with instructions that an AI agent can load when a request matches the skill's description. Think of it as a reference manual the agent reads before it starts working on a task.
This skill gives the agent a playbook for sanctioned phishing engagements. Once installed, the agent can walk through lookalike domain registration, SPF, DKIM and DMARC record setup, configuring GoPhish and an SMTP relay, building pretexts from OSINT, deploying EvilGinx2 phishlets, and choosing payload delivery vectors such as HTML smuggling or ISO containers. It also covers quishing (QR code phishing) and maps techniques to MITRE ATT&CK T1566 and its sub-techniques.
- Infrastructure: domain acquisition and aging, GoPhish deployment, SMTP configuration with Postfix or a relay provider
- Delivery: Office macros, HTA droppers, ISO/IMG containers, LNK hijacking, OneNote payloads, HTML smuggling
- Credential capture: EvilGinx2 and Modlishka session relay, pixel-perfect HTML cloning
- Tooling integrations: GoPhish, EvilGinx2, King Phisher, Social Engineering Toolkit, dnstwist
Install the offensive-phishing skill
Download the skill ZIP from this page. You can install it for yourself across all projects, or only for one project.
For a personal install, unzip the file into ~/.claude/skills/ so the offensive-phishing folder (containing SKILL.md) sits inside that directory. For a project-only install, unzip it into the project's .claude/skills/ folder instead.
You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Trigger the skill with natural requests
You do not need a special command. The agent loads the skill when your request matches its description, so describe the task in plain terms and state that the engagement is authorized and scoped. The skill itself asks you to document scope, target lists and escalation procedures before sending any email.
Good requests name the stage you need help with. Examples: asking how to age a lookalike domain before a sanctioned engagement, asking for the DNS records needed for SPF, DKIM and DMARC alignment, or asking how to configure GoPhish with a TLS certificate on a VPS.
- "We have a signed scope for a red team engagement. Walk me through provisioning sending infrastructure for a phishing test."
- "Help me set up GoPhish with Let's Encrypt certificates on a Linux VPS."
- "Map our planned phishing scenario to MITRE ATT&CK T1566 sub-techniques."
- "Suggest pretext ideas for a spear phishing test based on our public OSINT notes."
What you need before using it
The skill assumes operational comfort with DNS, Postfix, VPS deployment and the command line. It does not teach these basics. You also need written authorization and a defined scope from the target organization before any campaign execution.
The skill lists these requirements: a Linux VPS or server for GoPhish and mail infrastructure, GoPhish v0.12.1 downloaded from GitHub, Let's Encrypt via certbot, and either Postfix or an SMTP relay account with Amazon SES, Mailgun or SendGrid. Referenced tools include dnstwist, opendkim-genkey, whois, dig, EvilGinx2, King Phisher and the Social Engineering Toolkit.
- Linux VPS or server
- GoPhish v0.12.1 from GitHub
- certbot with Let's Encrypt
- Postfix or an SMTP relay account (Amazon SES, Mailgun or SendGrid)
- Written authorization and a defined scope
Safety notes: scripts and network access
The skill does not run scripts on its own. It is a text document the agent reads, and its commands are examples for you or the agent to run in your environment. It does use the network: the infrastructure steps involve DNS lookups, WHOIS queries, downloading GoPhish and requesting certificates.
Treat every command as something you would review before running. Nothing in the skill should be executed against systems you do not own or have permission to test. Using these techniques against an organization without written permission is illegal.
- Scripts: none are bundled; the file is instructional text
- Network: yes, for DNS, WHOIS, downloads and certificate issuance
- Review generated commands and confirm the target is in scope before running them
Tips for getting useful results from the skill
Give the agent your scope document's key constraints up front: permitted domains, target groups, time window and escalation contacts. The skill's workflow depends on these, such as sending test emails to your own accounts before the live launch.
Ask for the workflow in stages rather than all at once. Stage-by-stage help is easier to check against your authorization and easier to document in the final report.
- State authorization and scope in the first message
- Ask for one stage at a time, starting with infrastructure
- Use the skill's documentation step to record timestamps, screenshots and affected user counts
What people use it for
- Planning a sanctioned phishing simulation with a documented scope and ATT&CK mapping
- Checking SPF, DKIM and DMARC record setup for a test sending domain
- Structuring a GoPhish deployment on a VPS with TLS certificates
- Helping a blue team understand the attacker techniques its email controls must detect
Frequently asked questions
How do I install the offensive-phishing skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What do I need to use the offensive-phishing skill?
You need a Linux VPS or server, GoPhish v0.12.1, certbot with Let's Encrypt, and either Postfix or an SMTP relay account. Most importantly, you need written authorization and a defined scope from the target organization.
Is the offensive-phishing skill free?
The skill is published under the MIT licence, as shown on this page. The tools it references, such as GoPhish and EvilGinx2, are separate projects with their own licences, which you should check before use.
Can beginners use this skill to learn phishing awareness?
No. The skill covers operational attack tradecraft such as macro droppers, HTML smuggling and session relay. It assumes comfort with DNS, Postfix and command-line tools and is not training material for end users.
Does the skill run scripts automatically?
No. The skill bundles only a SKILL.md file and does not run scripts. It does involve network activity in the commands it describes, such as DNS lookups, WHOIS queries and downloads.
How does this compare with other phishing simulation tools?
The skill is a methodology document for an AI agent, not a tool. It references GoPhish, EvilGinx2, King Phisher and the Social Engineering Toolkit, which do the actual campaign work, so you still need those tools installed.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits red team operators and security consultants running sanctioned social engineering engagements with signed scope documents, and blue teams who want to understand the tradecraft their email controls must detect. It is not suitable for anyone without written authorization, for beginners seeking awareness training, or for non-technical users who are not comfortable with DNS, Postfix and the command line.
Download the skill