Social Engineering Pentest Planner
Plan and run authorized phishing, vishing and pretexting tests to measure staff security awareness.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
Once installed, the agent can help a security team plan a social engineering penetration test: profiling employees from public sources, choosing target groups, drafting phishing and vishing scripts, and setting up tools such as GoPhish, the Social Engineer Toolkit and Evilginx. It also includes Python helpers that pull campaign results from a GoPhish server and turn them into metrics reports. The goal is to find where people are fooled so training can be improved.
Great for
- Security consultants running an authorized human-attack-surface assessment
- Internal security teams planning phishing awareness exercises with written approval
- Students learning how red-team social engineering engagements are structured
Skip it if
- Testing anyone without written authorization, since sending deceptive emails or calls to real people without consent can be illegal and harmful
- Attacking third parties or real login pages, since the skill's own examples clone Office 365 and Okta login pages and enable credential capture
- Non-security use, since the material is operational attack tooling with limited context for beginners
Try asking
- “Help me scope a phishing test for our finance team with written approval and exclusions.”
- “Draft a GoPhish campaign plan and email templates for an authorized IT security awareness test.”
- “Write a vishing call script and escalation checklist for a help desk pretext test.”
- “Summarize GoPhish campaign results into click, submit and report rates for the security report.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
conducting-social-engineering-penetration-test.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip conducting-social-engineering-penetration-test.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip conducting-social-engineering-penetration-test.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Get signed authorization, legal review and HR/Legal coordination before any step; the skill itself lists these as prerequisites.
- Point the scripts only at your own GoPhish instance; note that they disable TLS certificate verification (verify=False), so use them on trusted networks or fix this first.
- Keep captured credentials out of reports and delete them after the engagement; the example config enables credential and password capture.
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.