| name | phishing-simulation-skill |
| description | Phishing simulation campaign execution and analysis for security awareness assessment |
| allowed-tools | ["Bash","Read","Write","Glob","Grep","WebFetch"] |
Phishing Simulation Skill
Purpose
Execute and analyze phishing simulation campaigns to assess organizational security awareness, identify high-risk users, and measure the effectiveness of security training programs.
Capabilities
Campaign Template Generation
- Create realistic phishing email templates
- Design landing pages for credential harvesting simulations
- Generate attachment-based simulation scenarios
- Create spear-phishing templates using OSINT
- Develop pretexting scenarios
- Build multi-stage attack simulations
Campaign Execution
- Schedule and launch simulation campaigns
- Manage target user groups
- Configure sending parameters (timing, throttling)
- Handle bounce and delivery tracking
- Implement safe landing pages
- Manage campaign duration and scope
User Response Tracking
- Track email open rates
- Monitor link click rates
- Record credential submission attempts
- Track attachment opens
- Measure response times
- Identify repeat offenders
Awareness Reporting
- Generate campaign summary reports
- Create department-level breakdowns
- Produce trend analysis over time
- Compare against industry benchmarks
- Generate executive dashboards
- Export data for further analysis
Risk User Identification
- Identify users who clicked links
- Flag users who submitted credentials
- Track repeat high-risk behavior
- Score user security awareness
- Prioritize users for additional training
Training Recommendations
- Recommend targeted training modules
- Suggest remedial training assignments
- Track training completion rates
- Correlate training with behavior improvement
- Generate training effectiveness reports
Simulation Types
| Type | Description | Risk Level |
|---|
| Mass Phishing | Broad awareness testing | Low |
| Spear Phishing | Targeted attacks | Medium |
| Whaling | Executive targeting | High |
| Vishing | Voice phishing | Medium |
| Smishing | SMS phishing | Medium |
| BEC | Business email compromise | High |
Template Categories
- Password reset notifications
- IT support messages
- Package delivery notifications
- Invoice/payment requests
- HR communications
- Executive requests
- Cloud service notifications
- Social media alerts
Integrations
- KnowBe4: Security awareness training platform
- Proofpoint: Security awareness and phishing simulation
- GoPhish: Open-source phishing framework
- Cofense: Phishing defense solutions
- Microsoft Defender: Attack simulation training
Target Processes
- Security Awareness Training Program
- Human Risk Assessment
- Social Engineering Testing
- Compliance Training Verification
Input Schema
{
"type": "object",
"properties": {
"campaignType": {
"type": "string",
"enum": ["mass", "spear", "whaling", "department", "new-hire"],
"description": "Type of phishing simulation"
},
"templateCategory": {
"type": "string",
"enum": ["password-reset", "it-support", "delivery", "invoice", "hr", "executive", "cloud-service"]
Output Schema
{
"type": "object",
"properties": {
"campaignId": {
"type": "string"
},
"campaignType": {
"type": "string"
},
"executionPeriod": {
"type": "object",
"properties": {
"startDate": { "type": "string" },
"endDate": { "type": "string" }
}
},
"targetSummary": {
"type": "object"
Usage Example
skill: {
name: 'phishing-simulation-skill',
context: {
campaignType: 'mass',
templateCategory: 'password-reset',
targetGroups: ['all-employees'],
difficulty: 'medium',
landingPageAction: 'awareness'
}
}
