Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Phishing Simulation Skill · a5c-ai | DecimalAI

a5c-ai/phishing-simulation-skill

SkillScore75Maintained

Phishing simulation campaign execution and analysis for security awareness assessment

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-phishing-simulation-skill/SKILL.md

decimalai skills pull a5c-ai-phishing-simulation-skill --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-phishing-simulation-skill/SKILL.md https://app.decimal.ai/s/a5c-ai-phishing-simulation-skill/SKILL.md

Raw file: /s/a5c-ai-phishing-simulation-skill/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-phishing-simulation-skill.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

Runs

all versions · 30d

Eval pass

100%

global

Used when offered

100%

used / offered · all versions

By model· real traffic, every org · 30d — not the benchmark

Model	Eval pass	Runs
gemini-3.6-flash	100%	4

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

24 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 26d ago

Yes — +58% lift · at higher cost+44% tokens0% turns75% of whole cases pass with skill (18/24)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	10%	0%
case-07	✗→✓	▲ Improved	97%	0%
case-08	✗→✓	▲ Improved	104%	0%
case-09	✗→✓	▲ Improved	22%	0%
case-10	✗→✓	▲ Improved	55%	0%

Showing 5 of 24 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/security-compliance/skills/phishing-simulation-skill/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

Phishing Simulation Skill

Purpose

Execute and analyze phishing simulation campaigns to assess organizational security awareness, identify high-risk users, and measure the effectiveness of security training programs.

Capabilities

Campaign Template Generation

Create realistic phishing email templates
Design landing pages for credential harvesting simulations
Generate attachment-based simulation scenarios
Create spear-phishing templates using OSINT
Develop pretexting scenarios
Build multi-stage attack simulations

Campaign Execution

Schedule and launch simulation campaigns
Manage target user groups
Configure sending parameters (timing, throttling)
Handle bounce and delivery tracking
Implement safe landing pages
Manage campaign duration and scope

User Response Tracking

Track email open rates
Monitor link click rates
Record credential submission attempts
Track attachment opens
Measure response times
Identify repeat offenders

Awareness Reporting

Generate campaign summary reports
Create department-level breakdowns
Produce trend analysis over time
Compare against industry benchmarks
Generate executive dashboards
Export data for further analysis

Risk User Identification

Identify users who clicked links
Flag users who submitted credentials
Track repeat high-risk behavior
Score user security awareness
Prioritize users for additional training

Training Recommendations

Recommend targeted training modules
Suggest remedial training assignments
Track training completion rates
Correlate training with behavior improvement
Generate training effectiveness reports

Simulation Types

| Type | Description | Risk Level | |------|-------------|------------| | Mass Phishing | Broad awareness testing | Low | | Spear Phishing | Targeted attacks | Medium | | Whaling | Executive targeting | High | | Vishing | Voice phishing | Medium | | Smishing | SMS phishing | Medium | | BEC | Business email compromise | High |

Integrations

KnowBe4: Security awareness training platform
Proofpoint: Security awareness and phishing simulation
GoPhish: Open-source phishing framework
Cofense: Phishing defense solutions
Microsoft Defender: Attack simulation training

Target Processes

Security Awareness Training Program
Human Risk Assessment
Social Engineering Testing
Compliance Training Verification

Input Schema

json
{
  "type": "object",
  "properties": {
    "campaignType": {
      "type": "string",
      "enum": ["mass", "spear", "whaling", "department", "new-hire"],
      "description": "Type of phishing simulation"
    },
    "templateCategory": {
      "type": "string",
      "enum": ["password-reset", "it-support", "delivery", "invoice", "hr", "executive", "cloud-service"],
      "description": "Phishing template category"
    },
    "targetGroups": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Target user groups or departments"
    },
    "schedule": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string", "format": "date-time" },
        "endDate": { "type": "string", "format": "date-time" },
        "sendingWindow": { "type": "string" }
      }
    },
    "difficulty": {
      "type": "string",
      "enum": ["easy", "medium", "hard", "expert"],
      "description": "Simulation difficulty level"
    },
    "landingPageAction": {
      "type": "string",
      "enum": ["awareness", "training-redirect", "credential-capture"],
      "description": "Action when user clicks link"
    },
    "customTemplate": {
      "type": "string",
      "description": "Path to custom template file"
    }
  },
  "required": ["campaignType", "targetGroups"]
}

Output Schema

json
{
  "type": "object",
  "properties": {
    "campaignId": {
      "type": "string"
    },
    "campaignType": {
      "type": "string"
    },
    "executionPeriod": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string" },
        "endDate": { "type": "string" }
      }
    },
    "targetSummary": {
      "type": "object",
      "properties": {
        "totalTargets": { "type": "integer" },
        "emailsSent": { "type": "integer" },
        "emailsDelivered": { "type": "integer" },
        "bounced": { "type": "integer" }
      }
    },
    "results": {
      "type": "object",
      "properties": {
        "emailsOpened": { "type": "integer" },
        "openRate": { "type": "number" },
        "linksClicked": { "type": "integer" },
        "clickRate": { "type": "number" },
        "credentialsSubmitted": { "type": "integer" },
        "submissionRate": { "type": "number" },
        "attachmentsOpened": { "type": "integer" },
        "reportedPhishing": { "type": "integer" },
        "reportRate": { "type": "number" }
      }
    },
    "departmentBreakdown": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "department": { "type": "string" },
          "clickRate": { "type": "number" },
          "riskScore": { "type": "number" }
        }
      }
    },
    "highRiskUsers": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "userId": { "type": "string" },
          "actions": { "type": "array" },
          "repeatOffender": { "type": "boolean" }
        }
      }
    },
    "trainingRecommendations": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "userGroup": { "type": "string" },
          "recommendedModules": { "type": "array" },
          "priority": { "type": "string" }
        }
      }
    },
    "benchmarkComparison": {
      "type": "object",
      "properties": {
        "industryAvgClickRate": { "type": "number" },
        "organizationClickRate": { "type": "number" },
        "performanceRating": { "type": "string" }
      }
    }
  }
}

Usage Example

javascript
skill: {
  name: 'phishing-simulation-skill',
  context: {
    campaignType: 'mass',
    templateCategory: 'password-reset',
    targetGroups: ['all-employees'],
    difficulty: 'medium',
    landingPageAction: 'awareness'
  }
}

Illustrative Want to see what a5c-ai/phishing-simulation-skill would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 09:42 UTC · 24 cases

Lift

+58%

75% vs 17%

Agent turns

1.0 vs 1.0

Tokens

+44%

2,864.54 vs 1,993.92

fail → pass · 14pass → pass · 4fail → fail · 6

Per-case results (24)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Please schedule a company-wide phishing simulation for our new hires using standard HR notification templates starting next Monday. I need the output to provide the campaign identifier, overall delivery counts, open and click metrics, department-level risk scores, identified high-risk accounts with repeat offender status, recommended training modules, and an industry benchmark comparison.	fail→fail	16,390	23,328	+42%	1	1	0%	1,934	3,684	+90%	0	0	—
case-02 Launch an advanced whaling simulation targeting executive leadership and finance personnel using urgent executive request scenarios. Format the results to return the unique campaign ID, execution period dates, send and bounce totals, interaction percentages, departmental risk breakdowns, flagged high-risk user profiles, and priority educational assignments compared against industry averages.	fail→fail	25,932	25,144	-3%	1	1	0%	2,499	5,118	+105%	0	0	—
case-03 Set up an IT support notification simulation aimed at the engineering group, configured at medium difficulty and directing users to an awareness landing page. Produce a full evaluation output containing campaign details, total emails delivered, click and credential submission rates, department risk summaries, repeat offenders, and targeted training recommendations with benchmark ratings.	fail→pass	22,182	15,332	-31%	1	1	0%	3,019	3,327	+10%	0	0	—
case-04 A user forwarded email headers and a raw EML file from spammer@phish-site.com requesting direct deposit updates. Analyze DKIM signatures and hop logs to triage this real email incident.	fail→fail	13,305	20,947	+57%	1	1	0%	2,120	4,461	+110%	0	0	—
case-05 Generate DNS records for domain company.com to enforce email security. Create TXT entries for SPF, DKIM selector s1, and a DMARC policy rejecting spoofed messages.	fail→fail	8,643	12,130	+40%	1	1	0%	1,764	3,027	+72%	0	0	—
case-06 An employee received an unexpected attachment invoice_9942.docm containing macros. Perform static malware analysis on the macro code to extract command-and-control server addresses.	fail→fail	14,006	17,260	+23%	1	1	0%	1,483	3,830	+158%	0	0	—
case-07 Generate an input JSON object for launching a spear-phishing test aimed at the finance group using invoice payment themes with expert difficulty and credential capture.	fail→pass	19,073	10,159	-47%	1	1	0%	1,332	2,623	+97%	0	0	—
case-08 Construct a JSON configuration payload for testing new hires using human resources template scenarios. Set the campaign category to new-hire and specify training redirect when links are clicked.	fail→pass	7,124	4,112	-42%	1	1	0%	1,230	2,504	+104%	0	0	—
case-09 Design an input payload for a department-wide security test targeting engineering and product departments with cloud service notification templates.	fail→pass	18,342	11,953	-35%	1	1	0%	2,162	2,640	+22%	0	0	—
case-10 Specify an input parameters payload for a low-difficulty mass phishing scenario for all staff with password reset alerts, setting the landing page action to awareness.	fail→pass	17,861	15,115	-15%	1	1	0%	1,356	2,108	+55%	0	0	—
case-11 Create an input schema JSON payload for a whaling simulation targeting executive management with executive request templates at hard difficulty.	fail→pass	18,667	11,481	-38%	1	1	0%	3,213	2,312	-28%	0	0	—
case-12 We are configuring an email simulation template simulating a package delivery alert. Produce the input JSON object with delivery category and medium difficulty.	fail→pass	13,583	8,712	-36%	1	1	0%	2,629	2,365	-10%	0	0	—
case-13 What are the allowed enum values for campaignType in the simulation input schema? List them under a key named types.	fail→pass	13,764	1,860	-86%	1	1	0%	1,474	2,052	+39%	0	0	—
case-14 What are the allowed enum values for landingPageAction in the simulation input schema? Output them under key actions.	fail→pass	22,772	7,374	-68%	1	1	0%	3,074	2,088	-32%	0	0	—
case-15 Output the JSON schema required fields list for the campaign input object.	fail→pass	6,533	6,898	+6%	1	1	0%	1,216	1,973	+62%	0	0	—
case-16 Produce a JSON report object summarizing user interaction results for a completed campaign, including open rate, click rate, submission rate, and report rate metrics.	pass→pass	10,744	8,677	-19%	1	1	0%	2,112	3,640	+72%	0	0	—
case-17 Formulate a JSON object representing high-risk user findings from a exercise, including user identifier, actions taken, and repeat offender status.	fail→pass	11,962	11,852	-1%	1	1	0%	2,527	2,539	+0%	0	0	—
case-18 Provide a JSON object structure for training recommendations generated after a campaign, incorporating group name, recommended modules, and priority level.	fail→fail	14,800	11,470	-23%	1	1	0%	1,898	3,564	+88%	0	0	—
case-19 Format a JSON response section comparing organization click rates against industry benchmarks and providing an overall performance rating.	fail→pass	14,019	9,235	-34%	1	1	0%	1,694	2,456	+45%	0	0	—
case-20 Create a JSON summary object for campaign delivery metrics tracking total target headcount, sent emails, successfully delivered messages, and bounces.	fail→pass	4,394	2,790	-37%	1	1	0%	852	2,158	+153%	0	0	—
case-21 Construct a JSON breakdown array for department-level metrics containing department name, click rate, and calculated risk score.	fail→pass	11,331	9,500	-16%	1	1	0%	1,324	2,474	+87%	0	0	—
case-22 Generate a full output JSON schema instance for a business email compromise simulation showing high risk classification and highRiskUsers list.	pass→pass	18,095	14,209	-21%	1	1	0%	3,577	3,747	+5%	0	0	—
case-23 Which open-source phishing framework and commercial platforms are listed as integrations for campaign execution?	pass→pass	7,649	13,473	+76%	1	1	0%	1,179	2,020	+71%	0	0	—
case-24 What risk levels are assigned to Whaling and Mass Phishing simulation types in security awareness testing standards?	pass→pass	17,828	11,598	-35%	1	1	0%	2,186	2,039	-7%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 24 cases were attempted. The headline lift of +58 percentage points is the difference between those two pass rates over the 24 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 16.7%
Pass rate with the skill: 75%
Cases attempted: 24
Cases counted toward lift: 24
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 09:42 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

Set up an IT support notification simulation aimed at the engineering group, configured at medium difficulty and directing users to an awareness landing page. Produce a full evaluation output containing campaign details, total emails delivered, click and credential submission rates, department risk summaries, repeat offenders, and targeted training recommendations with benchmark ratings.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run75

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+26% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 26 days ago

Other measured skills in the registry, with their headline benchmark lift.