Guide · Agent skill
How to use the Vishing Pretext Call Assessment agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the conducting-social-engineering-pretext-call skill, a set of instructions and scripts that lets an AI agent help a security tester plan and document an authorized phone-based social engineering test, known as vishing. It is written for people who have not used agent skills before. By the end you will know what the skill does, how to install it, how to phrase requests so the agent uses it, and what limits apply.
Vishing Pretext Call Assessmentmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the ZIP from this page and unzip it. Confirm that SKILL.md is at the top level of the skill folder.
- 2Place the skill. Move the folder into ~/.claude/skills/ for personal use or .claude/skills/ inside a project, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Confirm requirements. Install Python 3 and theHarvester, and confirm you have written client authorization, an approved target list and call recording consent.
- 4Ask for the task. Describe the engagement in plain language, stating the client, the authorization and the output you need.
- 5Plan the pretext. Have the agent draft scenarios and check them against the pretext checklist and the client's approval.
- 6Log and report. Record each call in the template format, run scripts/process.py on the log and fill in the report template.
What this skill makes the agent do
The skill teaches an AI agent how a security tester runs an authorized pretext call. A pretext is a believable story, such as a caller claiming to be from the IT help desk, used to test whether staff follow verification procedures. The source workflow has five phases: OSINT and target research, pretext development, call execution, data collection and metrics, and reporting.
The skill is meant for red team engagements where the client has given written permission. It is not a tool for calling people on your own initiative.
- Gathers public information about the client's organization for the research phase
- Drafts caller scenarios such as an IT help desk call, with a pretext checklist to review them
- Provides objection-handling tables and a call structure
- Describes the fields to record for each call and the success metrics used in a report
- Includes a report template with engagement details, results summary and call log
Install the skill from the ZIP download
Download the ZIP for this skill from this page and unzip it. The skill folder must contain the SKILL.md file at its top level so the agent can find it.
For a personal install, place the unzipped folder in ~/.claude/skills/. For a project-specific install, place it in the project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills
Check what you need before you start
The skill itself needs Python 3 to run its two scripts, scripts/agent.py and scripts/process.py. The OSINT step refers to theHarvester, which is not bundled, so you must install it separately. The skill also uses the network.
The most important requirements are not software. You need written client authorization, an approved target list, and call recording consent where your jurisdiction requires it.
- Python 3 for scripts/agent.py and scripts/process.py
- theHarvester for the OSINT step (referenced in the workflow, not included)
- Written client authorization with defined scope and boundaries
- An approved target list, usually supplied by the client
- Call recording consent, following the laws where you operate
- Pretext scenarios approved by the client
Trigger the skill with natural requests
You do not need special syntax. Describe the engagement task in plain language and mention the authorized context. The agent should match the request to the skill's description. Good requests name the goal, the client and the output you need.
State the authorization up front. Requests that ask for a script to extract passwords from strangers will not match the skill's purpose, and the skill's own rules forbid this.
- "Help me plan an authorized vishing pretext call test for a client that signed our scope document."
- "Draft an IT help desk pretext and objection responses for our approved target list."
- "Build a call log template and susceptibility tracker for the vishing report."
- "Fill in the vishing assessment report template for the engagement we just finished."
Run the bundled scripts
The skill bundles scripts/agent.py, which generates pretext templates, and scripts/process.py, which logs call results and calculates susceptibility metrics for a security awareness report. Ask the agent to explain what inputs each script expects, then review the code before you run it on client data.
Keep call records in the format the template defines. The template lists fields such as campaign ID, target, department, pretext, credential disclosed, verified and reported.
- Read the script source before running it
- Run it only in an environment you control
- Keep client data out of shared or public locations
Safety notes on scripts and network use
The skill runs scripts and uses the network, so treat it like any other code you install. Review scripts/agent.py and scripts/process.py, and check what the OSINT step sends over the network before running it.
The skill's ethical section requires you to obtain written authorization, avoid threatening language, document consent, report disclosed credentials to the client immediately, and never publicly identify employees who failed. The skill does not provide legal advice on call recording.
- Review the scripts before running them
- Confirm the scope and consent in writing before any call
- Report any disclosed credentials to the client immediately
- Do not name individual employees who failed in any report
- Check telecommunications and recording laws in your jurisdiction
What people use it for
- Planning an approved IT help desk pretext for a client's staff and drafting objection responses
- Building a call log and susceptibility tracker for a security awareness report
- Preparing the engagement details and results sections of a vishing assessment report
- Training red team staff on call structure and ethical limits using the skill's scenarios
Frequently asked questions
How do I install the vishing pretext call agent skill?
Download the ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder, or upload it in the Claude apps under Settings → Capabilities → Skills.
What do I need to run this skill?
You need Python 3 for the bundled scripts, and theHarvester for the OSINT step, which is not bundled. The more important requirements are written client authorization, an approved target list and call recording consent.
Is this skill free to use?
The source lists the skill under the Apache-2.0 licence. Check the licence file in the download for the terms that apply to your use.
Can I use this skill to call people without permission?
No. The skill is meant only for red team engagements where the client has given written permission, and the skill's own guidance requires written authorization before any test.
Does the skill give legal advice on call recording?
No. Recording laws vary by location, and the skill does not provide legal advice, so get a legal review of call recording before testing.
What is the difference between this skill and a phishing simulation tool?
This skill covers phone-based pretext calls, not email. It provides scenario planning, objection handling, call logging and metrics for voice-based tests. The source does not compare it with other tools, so check the requirements against your engagement.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security consultants and awareness teams running a vishing test that has written client authorization, an approved target list and recording consent in place. It is not suitable for anyone who wants to call people without permission or to target individuals for personal gain. If you need a general email phishing simulator or a tool with no scripts and no network use, pick something else.
Download the skill