Why this verdict
- suspicious: finding skill:skills/performing-red-team-phishing-with-gophish:skills/performing-red-team-phishing-with-gophish/SKILL.md:77:SUPPLY
- suspicious: finding skill:skills/performing-red-team-phishing-with-gophish:skills/performing-red-team-phishing-with-gophish/scripts/agent.py:20:CRED
- suspicious: finding skill:skills/performing-red-team-phishing-with-gophish:skills/performing-red-team-phishing-with-gophish/scripts/agent.py:38:CRED
- suspicious: finding skill:skills/performing-red-team-phishing-with-gophish:skills/performing-red-team-phishing-with-gophish/scripts/agent.py:89:MANIP
Security findings 4
Credential access
highContextual riskmedium confidenceThe GoPhish connection helper hardcodes verify=False, disabling TLS certificate verification while transmitting the GoPhish API key to the configured host so the credential can be intercepted by a man-in-the-middle; this security-weakening choice (echoed in both code examples) is not declared in the skill's description.
api = Gophish(api_key, host=host, verify=False)
vector:code
Counter-argument considered
connect_gophish hardcodes verify=False for any host with no lab guard or opt-out, so the API key is sent over an unauthenticated TLS channel; the '# Self-signed cert on localhost lab' comment appears only in the SKILL.md example, not in the unscoped helper, and the declared description never mentions disabling certificate verification.
Credential access
highContextual risklow confidencecreate_landing_page defaults capture_credentials=True, so campaigns built with this function harvest credentials submitted by email recipients and deliver them to the operator-configured GoPhish server.
capture_credentials=capture_credentials,
vector:code
Counter-argument considered
Credential-capturing landing pages delivering submissions to the operator's own GoPhish server are the artifact's explicitly declared core capability (description cites credential submission statistics; declared claim D2 'Create landing pages for credential capture'), so the harm carve-out applies and the behavior is declared, killing the finding.
Manipulation
mediumContextual risklow confidencelaunch_campaign posts a Campaign binding a phishing template, credential-capture page, SMTP profile, and target group, sending deceptive emails to the targets and routing their interactions to the capture page.
result = api.campaigns.post(campaign)
vector:code
Counter-argument considered
Posting a Campaign that binds template, page, SMTP profile, and target group is precisely the declared core capability of this authorized-phishing-simulation skill (description: launching campaigns; instructions: 'Launch and monitor campaigns'), so the harm carve-out applies and every element of the claim is declared.
Supply chain
mediumContextual risklow confidenceSKILL.md instructs an unpinned install of the gophish and requests packages from PyPI, so the code executed during the mandated setup step is not version-pinned; this unpinned install surface is not covered by the artifact's declaration.
Install dependencies: `pip install gophish requests`
vector:instruction
Counter-argument considered
The Instructions step directs the agent to run an unpinned PyPI install, which falls outside the pinned-official-registry carve-out and is covered by no declared claim (the description only names the gophish library, and residue R5/DET:ed61574e8d165149 flag the install as undeclared); it stands as a low contextual supply risk.
Open questions 4
What the analysis could not settle from the code alone.
The frontmatter MITRE tags list T1003 (credential dumping) and T1110 (brute force), techniques that no unit shown in this pass implements; does any other file of this artifact perform credential dumping or password brute forcing beyond the declared GoPhish simulation scope?
Credential access
The SKILL.md frontmatter claims MITRE techniques T1003 (OS Credential Dumping) and T1110 (Brute Force) that no shipped code in agent.py or api-reference.md implements; it is unclear whether this mapping is decorative metadata or whether additional capabilities exist in files not shown.
SKILL.md frontmatter claims MITRE techniques T1003 (OS Credential Dumping) and T1110 (Brute Force) that no shown code implements; confirm whether other files in the skill implement credential dumping or brute-force behavior.
Credential access
CLI main() parses --campaign-name/--template-name but never invokes launch_campaign, create_landing_page, create_email_template, or create_smtp_profile, so the declared campaign-launch capability is unreachable from the documented command; confirm the intended invocation path (library import versus CLI).
