Guide · Agent skill
How to use the Offensive Social Engineering agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-social-engineering skill is a reference playbook for an AI agent that supports authorized red team and physical penetration testing work beyond email phishing, covering topics such as pretexting, vishing, smishing, physical access and OSINT. It is aimed at professional testers and security teams who already hold written authorization and a defined scope. This guide explains what the skill does, how to install it, how to trigger it with natural requests, and the safety conditions you must meet before using it.
Offensive Social EngineeringSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this directory page.
- 2Unzip into a skills folder. Extract the offensive-social-engineering folder into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder.
- 3Or upload in the Claude apps. Go to Settings, then Capabilities, then Skills, and upload the skill there if you use the Claude apps.
- 4Confirm authorization. Check that you have signed written authorization and rules of engagement covering each vector before you start.
- 5Make a scoped request. Describe the engagement, the vector and the objective in plain language so the agent loads the skill.
- 6Document and debrief. Record decisions and outcomes, then use the skill to draft the debrief and recommendations.
What does the skill make the agent do?
Agent skills are folders of instructions that an AI agent loads when a task matches the skill's description. This one contains a structured methodology for social engineering engagements that go beyond email. Its SKILL.md file covers pretexting methodology, voice and text channels, physical access testing, USB-based test devices, watering hole planning and OSINT-driven targeting.
It also maps the methodology to MITRE ATT&CK techniques T1598, T1566, T1091 and T1189, and names several tools it integrates with, including the Social Engineering Toolkit, Proxmark3, USB Rubber Ducky, Bash Bunny, O.MG cable and BeEF.
The skill is a planning and reference aid. It does not run scripts, and this guide does not reproduce its operational attack instructions.
How do you install the offensive-social-engineering skill?
Download the ZIP of the skill from this directory page. Unzip it so the offensive-social-engineering folder, containing SKILL.md, sits in one of these locations.
For a personal setup, place it in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.
In the Claude apps, you can instead upload the skill under Settings, then Capabilities, then Skills.
- Personal install: ~/.claude/skills/offensive-social-engineering/
- Project install: .claude/skills/offensive-social-engineering/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload
How do you trigger the skill with a natural request?
You do not need a special command. Describe the engagement in plain language and name the vector you are testing. The agent should load the skill when the request matches its description.
Good requests state the authorization and scope up front, because the skill itself reminds you to confirm scope and legal limits first.
- Help me plan the scope and rules of engagement for a written-authorized vishing test against our helpdesk.
- Build a training scenario that tests staff against smishing, with a debrief plan.
- Outline OSINT research limits and the data I should not collect for a signed physical penetration test.
- Map our planned tailgating test to the relevant MITRE ATT&CK technique and list the approvals I need.
What do you need before you use it?
The listed requirements are Python 3 with the twilio package, a Twilio account with a purchased phone number, and a VPS with Asterisk PBX if you use the Asterisk option. Optional tools referenced include the Social Engineering Toolkit, Proxmark3, USB Rubber Ducky, Bash Bunny, O.MG cable and BeEF.
The skill is listed as using the network. Its scripts are examples in its text rather than files the skill runs on its own.
- Python 3 with the twilio package (listed requirement)
- Twilio account and purchased phone number (listed requirement)
- VPS and Asterisk PBX, only for the Asterisk option
- Optional hardware and tools: Proxmark3, USB Rubber Ducky, Bash Bunny, O.MG cable, plus software tools such as the Social Engineering Toolkit and BeEF
What safety conditions apply?
Every technique in the skill requires explicit written authorization and defined rules of engagement. Physical testing adds legal questions about trespass, impersonating officials and recording laws, which vary by jurisdiction. Confirm that your signed scope covers each vector before you act on any output.
Do not use this skill against personal accounts or against organizations that have not consented. The techniques target real people, so keep staff wellbeing, data handling and debrief obligations in your plan from the start.
- Get signed written authorization that names each vector in scope
- Agree rules of engagement, including stop conditions and who to call if something goes wrong
- Confirm recording and data-handling rules for your jurisdiction
- Do not collect personal data beyond what the engagement needs
- Plan a debrief so staff who were tested learn from it
What tips help you get value from the skill?
Use the skill for planning, documentation and training design as much as for execution. Ask the agent to produce a scope checklist, a timeline or a debrief template, and check each output against your authorization before use.
If you are building awareness training rather than running a live test, say so in your request. The agent can then focus on scenario design and defensive lessons instead of operational detail.
- Start every request with the authorization status and scope
- Ask for documentation templates alongside any plan
- Review all outputs with your legal or compliance contact before use
What people use it for
- Planning the scope and rules of engagement for a signed red team engagement
- Designing a staff training scenario that tests vishing or smishing awareness
- Drafting a documentation template for a physical penetration test
- Mapping a planned test to MITRE ATT&CK techniques for a client report
Frequently asked questions
How do I install the offensive-social-engineering skill?
Download the ZIP from this directory page and unzip the offensive-social-engineering folder into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings, then Capabilities, then Skills.
What do I need to run it?
The listed requirements are Python 3 with the twilio package and a Twilio account with a purchased phone number, plus a VPS and Asterisk PBX if you use the Asterisk option. Optional tools include the Social Engineering Toolkit, Proxmark3, USB Rubber Ducky, Bash Bunny, O.MG cable and BeEF.
Is the offensive-social-engineering skill free?
The listing states the licence is MIT. Check the licence file in the source repository for the full terms before you redistribute it.
Can I use this skill without authorization?
No. Every technique requires explicit written authorization and defined rules of engagement. Using it against personal accounts or non-consenting organizations is illegal in most jurisdictions.
Does the skill run scripts on my computer?
The listing says it does not run scripts, although it uses the network. Its code samples are reference text in SKILL.md rather than programs the skill launches.
Is this a good guide for general security awareness?
Not really. The content is operational attack methodology, so beginners looking for defensive advice should use a dedicated security awareness resource instead.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits professional red team operators and physical penetration testers who have signed written authorization and a defined scope, and security teams designing vishing or smishing training. It is a poor fit for anyone without authorization, and for beginners who want defensive awareness guidance rather than attack methodology.
Download the skill