How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

performing-phishing-simulation-with-gophish - Skill

Name: performing-phishing-simulation-with-gophish
Author: mukul975

Imported from mukul975/anthropic-cybersecurity-skills (skills/performing-phishing-simulation-with-gophish/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill performing-phishing-simulation-with-gophish. Copyright stays with the author (Apache-2.0).

Performing Phishing Simulation with GoPhish

Overview

GoPhish is an open-source phishing simulation framework used by security teams to conduct authorized phishing awareness campaigns. It provides campaign management, email template creation, landing page cloning, and comprehensive reporting. This skill covers deploying GoPhish, creating realistic phishing scenarios, and analyzing campaign results to measure and improve organizational resilience.

When to Use

When conducting security assessments that involve performing phishing simulation with gophish
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

GoPhish binary or Docker image (https://github.com/gophish/gophish)
SMTP server or relay for sending test emails
Written authorization from management for phishing simulation
Target email list (HR-approved)
SSL/TLS certificate for landing pages
Python 3.8+ for automation scripts

Key Concepts

GoPhish Architecture

Admin Panel: Web UI for campaign management (default port 3333)
Phishing Server: Serves landing pages and tracks clicks (default port 80/443)
SMTP Configuration: Outbound email sending profile
Campaign Engine: Orchestrates email delivery, tracking, and reporting

Campaign Components

Sending Profile: SMTP server configuration for outbound email
Email Template: The phishing email content with tracking
Landing Page: The fake page users are directed to
User Group: Target recipients for the campaign
Campaign: Combines all components with scheduling

Workflow

Step 1: Deploy GoPhish

# Docker deployment
docker pull gophish/gophish
docker run -d --name gophish -p 3333:3333 -p 8080:80 gophish/gophish

# Or binary deployment
wget https://github.com/gophish/gophish/releases/latest/download/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip
chmod +x gophish
./gophish

Step 2: Configure Sending Profile

Name: "Internal Mail Server"
SMTP From: awareness-test@yourdomain.com
Host: smtp.yourdomain.com:587
Username/Password: Service account credentials
Enable TLS

Step 3: Create Email Template

Use realistic scenarios: password reset, IT notification, HR update
Include GoPhish tracking pixel: {{.Tracker}}
Include phishing link: {{.URL}}
Personalize with {{.FirstName}}, {{.LastName}}, {{.Position}}

Step 4: Create Landing Page

Clone legitimate login page using GoPhish's import feature
Enable credential capture (for authorized testing only)
Configure redirect to training page after submission
Add SSL certificate for HTTPS

Step 5: Import Users and Launch Campaign

Import CSV with: First Name, Last Name, Email, Position
Set campaign schedule (stagger sends to avoid detection)
Launch and monitor in real-time

Step 6: Analyze Results with process.py

Use the automation script to pull campaign data via GoPhish API and generate detailed analytics reports.

Tools & Resources

GoPhish: https://getgophish.com/
GoPhish API Docs: https://docs.getgophish.com/api-documentation/
GoPhish GitHub: https://github.com/gophish/gophish
Evilginx2 (for advanced AiTM testing): https://github.com/kgretzky/evilginx2
King Phisher: https://github.com/rsmusllp/king-phisher

Validation

Successfully deploy GoPhish and access admin panel
Create and send a test phishing email to a test mailbox
Capture simulated credentials on landing page
Generate campaign report with open/click/submit rates
Redirect users to awareness training after interaction

Install performing-phishing-simulation-with-gophish and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "mukul975-anthropic-cybersecurity-skills-performing-phish-820779", "kind": "skill", "name": "performing-phishing-simulation-with-gophish", "description": "Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user groups, and campaign reporting to measure click and credential-submission rates. Use when planning or executing a phishing simulation for employee security-awareness testing or measuring susceptibility to social engineering.", "publisher": "mukul975", "version": "1.0.0", "capabilities": { "domains": [ "marketing" ], "tags": [ "skill-md", "phishing", "email-security", "social-engineering", "dmarc", "awareness", "gophish", "simulation", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user groups, and campaign reporting to measure click and credential-submission rates. Use when planning or executing a phishing simulation for employee security-awareness testing or measuring susceptibility to social engineering." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills", "path": "skills/performing-phishing-simulation-with-gophish/SKILL.md", "ref": "HEAD", "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/performing-phishing-simulation-with-gophish/SKILL.md", "key": "mukul975/anthropic-cybersecurity-skills/skills/performing-phishing-simulation-with-gophish/SKILL.md" }, "license": "Apache-2.0" }, "instructions": "# Performing Phishing Simulation with GoPhish\n\n## Overview\nGoPhish is an open-source phishing simulation framework used by security teams to conduct authorized phishing awareness campaigns. It provides campaign management, email template creation, landing page cloning, and comprehensive reporting. This skill covers deploying GoPhish, creating realistic phishing scenarios, and analyzing campaign results to measure and improve organizational resilience.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing phishing simulation with gophish\n- When following incident resp", "cost": { "context_tokens": 941 } }

performing-phishing-simulation-with-gophish

About