Guide · Agent skill
How to use the Social Engineering Pentest Planner agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide shows you how to install and use the conducting-social-engineering-penetration-test skill, an agent skill that helps a security team plan a social engineering penetration test covering phishing, vishing, smishing and physical pretexting. It is written for people who may never have used an agent skill before. By the end you will know what the skill makes the agent do, how to install it, how to ask for help with natural requests, and what safety limits to respect.
Social Engineering Pentest Plannermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill as a ZIP file from this page.
- 2Unzip into a skills folder. Unzip into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Or upload it in the apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- 4Install the requirements. Install Python 3 and the requests library, and confirm you have a GoPhish server and API key.
- 5Confirm authorization and scope. Get written approval and define target groups, attack types and exclusions before starting.
- 6Ask in plain language. Describe the authorized task, such as profiling, drafting scripts or producing a metrics report.
- 7Review the output. Check every script, command and target before use, and fill in the report template with anonymised results.
What an agent skill is and what this one does
An agent skill is a folder of instructions and supporting files that an AI agent loads when a request matches the skill's purpose. This one is described in its SKILL.md file as a way to design and execute a social engineering penetration test that combines OSINT-driven target profiling with phishing, vishing, smishing and physical pretexting campaigns.
Once installed, the agent can help a security team profile employees from public sources, choose target groups, draft phishing and vishing scripts, and set up tools such as GoPhish, the Social Engineer Toolkit (SET) and Evilginx. The goal, in the skill's own words, is to measure human security resilience and identify security awareness training gaps.
- Phase 1: OSINT and target profiling, including a target selection matrix by employee group
- Phase 2: phishing infrastructure, GoPhish campaign configuration and email templates by pretext
- Phase 3: vishing call script template and metrics to track
- Reporting: a report template with campaign result tables and a department risk matrix
How to install the skill from the ZIP download
Download the skill as a ZIP file from this page and unzip it. You can install it for yourself across all projects or for a single project.
For personal use, unzip the folder into ~/.claude/skills/. For one project, unzip it into that project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- Personal install: place the unzipped skill folder in ~/.claude/skills/
- Project install: place it in the project's .claude/skills/ folder
- Claude apps: upload the ZIP under Settings → Capabilities → Skills
What the skill needs before you run it
The skill's requirements are Python 3 with the requests library, a GoPhish server and its API key, and a VPS and sending domain for phishing infrastructure. The instructions also reference theHarvester, GoPhish, the Social Engineer Toolkit, Evilginx, and Maltego. The skill's own prerequisites add written authorization from senior management, a legal review, a defined scope, and coordination with HR and Legal.
The skill's API reference lists requests as the GoPhish REST API client, installed with pip install requests. It also lists an official gophish Python client.
- Python 3 with the requests library
- A GoPhish server and its API key
- A VPS and a sending domain
- Written authorization and a defined scope before any test
pip install requestsHow to trigger the skill with natural requests
You do not need special syntax. Describe the task in plain language that matches the skill's purpose: scoping an authorized test, planning a phishing awareness exercise, drafting a vishing script, or turning GoPhish results into a metrics report.
Always state that the work is authorized and name the scope. The skill's guidance expects written approval, and the agent will work from that context.
- "Help me plan an authorized phishing awareness test for our finance team. We have written approval from the CISO."
- "Draft a vishing pretext for our IT help desk test and list the metrics to track."
- "Profile the public email format and employee roles for targetcorp.com, within our approved scope."
- "Pull the campaign results from our GoPhish server and produce a metrics report."
What the Python helpers do
The skill includes two Python scripts. scripts/agent.py and scripts/process.py are the helpers the skill provides for working with GoPhish. According to the skill's assessment, they pull campaign results from a GoPhish server and turn them into metrics reports. The API reference lists the GoPhish endpoints used, such as listing campaigns and fetching campaign results.
The metrics are defined by simple formulas in the reference: open rate, click rate, submit rate and report rate, each calculated against emails sent.
- Campaign results are read from the GoPhish REST API
- Open rate = emails_opened / emails_sent x 100
- Click rate = links_clicked / emails_sent x 100
- Submit rate = data_submitted / emails_sent x 100
- Report rate = reported / emails_sent x 100
Safety notes on scripts and network use
This skill runs scripts and uses the network. The scripts talk to a GoPhish server, so the server address and API key must belong to infrastructure you are authorized to use. Review the scripts before running them and point them only at your own test environment.
The skill's material is operational attack tooling. Its examples clone Office 365 and Okta login pages and describe credential capture and MFA bypass with Evilginx, so treat those parts as strictly limited to authorized work. The skill's own legal notes say you must have explicit written authorization, must not target personal email or devices without consent, must comply with GDPR for EU employees, must not use real malware or destructive payloads, and must anonymise results.
- Use only against systems and people covered by written authorization
- Do not test personal email or devices without consent
- Do not use real malware or destructive payloads
- Anonymise results and coordinate employee notification with HR and Legal
Tips for getting useful output
Give the agent your real scope: which groups are in, which vectors are allowed, and what is excluded. Ask it to fill the report template in assets/template.md so results come out in a consistent structure. Ask for the training recommendations to be tied to the department risk matrix, since the goal is to find where people are fooled so training can be improved.
Keep the standards in references/standards.md in view. It lists PTES, NIST SP 800-50, the SANS Security Awareness Maturity Model and MITRE ATT&CK references that you can cite in your report.
- State scope and authorization in the first message
- Ask for output in the assets/template.md structure
- Tie recommendations to training gaps by department
- Cite references/standards.md when writing the report
What people use it for
- Scoping an authorized phishing awareness exercise for a finance team with written approval
- Drafting a vishing call script for an IT help desk test and listing the metrics to track
- Pulling campaign results from a GoPhish server and generating a metrics report
- Filling the report template with campaign results and a department risk matrix
- Comparing phishing, vishing and physical test results to plan training
Frequently asked questions
How do I install the social engineering pentest planner skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What do I need to run this skill?
You need Python 3 with the requests library, a GoPhish server and its API key, and a VPS and sending domain. The skill also expects written authorization, a legal review and a defined scope.
Is this skill free to use?
The skill is licensed under Apache-2.0, as stated on this page. Check the license file in the download for the terms that apply to your use.
Can I use it without written authorization?
No. The skill's own legal notes require explicit written authorization, and sending deceptive emails or calls to people without consent can be illegal and harmful. It is for authorized assessments only.
What tools does it work with?
The instructions reference GoPhish, the Social Engineer Toolkit (SET), Evilginx, theHarvester and Maltego. The Python helpers focus on pulling results from a GoPhish server into metrics reports.
Is there an alternative if this is not right for me?
If you are new to social engineering testing or want a non-operational overview, a general security awareness training programme or the NIST SP 800-50 guidance referenced in the skill may suit you better than the attack-focused material here.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security consultants running authorized human-attack-surface assessments, internal teams planning phishing awareness exercises with written approval, and students learning how red-team engagements are structured. It is not suited to testing anyone without written authorization, to attacking third parties or real login pages, or to non-security use, since the material is operational attack tooling with limited beginner context.
Download the skill