Guide · Agent skill
How to use the Spearphishing Simulation Campaign agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the Spearphishing Simulation Campaign agent skill does, how to add it to an AI agent, and how to ask for its help with an authorized targeted phishing exercise. It is written for readers who have not used agent skills before. By the end you will know the install options, the prerequisites, the safety limits you must respect, and how to phrase requests that trigger the skill.
Spearphishing Simulation Campaignmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip the conducting-spearphishing-simulation-campaign folder.
- 2Place the folder. Move it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install prerequisites. Install Python 3.8 or newer and the packages requests, dnspython, rich and jinja2.
- 4Set up GoPhish. Have a GoPhish server running with its API key, plus a registered test domain and an SMTP relay.
- 5Review the scripts. Read scripts/agent.py and scripts/process.py and confirm what network calls they make before running them.
- 6Make a scoped request. Ask the agent for a specific task, stating the authorized engagement and scope.
What the skill makes the agent do
The skill is a structured playbook for red-team exercises that simulate targeted phishing against specific named staff. Its SKILL.md describes five phases: pretext development from OSINT findings, payload development, infrastructure setup, campaign execution, and post-campaign analysis.
It also includes Python helper scripts (scripts/agent.py and scripts/process.py) that, according to the skill description, call the GoPhish API and check DNS email-authentication records. Supporting references cover GoPhish API endpoints, standards mappings and workflows, and a report template in assets/template.md.
- Pretext development: review OSINT findings, pick a theme and draft templates
- Infrastructure: look-alike domain planning and SPF, DKIM and DMARC configuration
- Campaign execution: send in waves, monitor delivery and track clicks and credential submissions
- Analysis: calculate delivery, open, click and credential-capture rates and map results to MITRE ATT&CK
- Reporting: fill in the campaign report template
Install the skill from the ZIP download
Download the skill ZIP from this page and unzip it. You can install it in one of two places depending on how you work with your agent.
For a personal setup, unzip the folder into ~/.claude/skills/. To limit it to one project, unzip it into that project's .claude/skills/ folder. If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Single project: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills, then upload
Check the requirements before you start
The skill needs a working Python environment and several external pieces. Set these up before asking the agent to run anything, because the scripts depend on them.
The skill also states that it runs scripts and uses the network, so review the scripts and confirm where they send traffic before running them in your environment.
- Python 3.8 or newer
- Python packages: requests, dnspython, rich, jinja2
- A GoPhish server and its API key
- A registered test domain and an SMTP relay
- Access to DNS records for domain checks
How to trigger the skill with natural requests
You do not need a special command. Describe the task in plain language and state the authorization context, since the skill is written for authorized engagements only. Name the engagement and the scope so the agent works within it.
Good requests name the goal and the stage. For example, you can ask the agent to check whether a test domain's SPF, DKIM and DMARC records are in place, or to draft the metrics section of a campaign report from results you already have.
- Check whether the SPF, DKIM and DMARC records for our authorized test domain are configured correctly.
- Using the GoPhish API details I provide, summarise the results of campaign ID 12 for the engagement report.
- Fill in the campaign report template with the metrics from our signed-off simulation.
- Explain the post-campaign analysis phase steps for our targeted phishing exercise.
Safety limits and scope
The skill is for authorized security testing and educational purposes only. Its own legal notice says unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
The skill's tool table also lists offensive frameworks such as Evilginx2 and Modlishka. Treat that table as reference material, not an instruction to use them. Confirm that written authorization, scope and a cleanup plan exist before any campaign starts. The workflow includes a cleanup step, and the validation checklist asks you to confirm it was performed.
- Get written authorization that names the targets, domains and dates
- Test on a lab or approved engagement first
- Launch in waves rather than mass sending, as the workflow advises
- Clean up campaign infrastructure afterward and document it
What people use it for
- Checking that a sanctioned test domain has SPF, DKIM and DMARC records in place before an exercise
- Drafting the metrics section of a red-team report from campaign results
- Structuring a targeted phishing simulation for a security team's own staff in an approved lab
- Teaching students how the phases of a targeted phishing engagement fit together
Frequently asked questions
How do I install the spearphishing simulation agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
What do I need to run the conducting-spearphishing-simulation-campaign skill?
You need Python 3.8 or newer with requests, dnspython, rich and jinja2, a GoPhish server and its API key, a registered test domain with an SMTP relay, and access to DNS records for domain checks.
Is the spearphishing simulation skill free?
The skill is listed under the Apache-2.0 licence. The tools it references, such as GoPhish, are listed as open source in the skill's tool table. Check the licence file in the package for the terms that apply to you.
Can I use this skill without authorization?
No. The skill is for authorized security testing only, and its own notice says unauthorized use against systems you do not own or have written permission to test may be illegal.
What are the alternatives to this skill?
The skill's tool table lists GoPhish, King Phisher, SET, Modlishka, CredSniper and Fierce Phish. This skill is distinct in packaging its phases as a playbook an agent can follow and in including helper scripts for the GoPhish API and DNS checks. Choose a tool based on your engagement scope and your team's experience.
Why do my GoPhish or DNS checks fail?
Check the basics first: the Python version, that the four packages are installed, that your GoPhish server is reachable with the correct API key, and that you have DNS access for the test domain. The skill's references describe the GoPhish API endpoints you can compare against.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits red teams with written authorization, security teams testing their own staff in a lab or approved engagement, and security students learning how targeted phishing exercises are structured. It assumes expert judgment and is a poor fit for anyone without authorization or without the ability to scope, contain and clean up a campaign safely. Choose a different resource if you need a general security awareness training tool instead.
Download the skill