[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71ARDGKEDSFNXWAADACFKAF":3,"skill-same:01M71ARDGKEDSFNXWAADACFKAF":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":6,"ownerDescription":66,"updatedAt":67,"install":68,"resources":80},"01M71ARDGKEDSFNXWAADACFKAF","cyber-conducting-social-engineering-penetration-test",null,"Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-conducting-social-engineering-penetration-test\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"social","penetration","test","social engineering","cyber conducting social engineering penetration test","engineering","conducting social engineering penetration test","red-team","security","human","security-awareness","subdomain","resilience","team","false","cybersecurity","design","testing","training","SET","2026-11-10 10:12:30",false,"---\nname: cyber-conducting-social-engineering-penetration-test\ndescription: \"Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: conducting-social-engineering-penetration-test | description: Design and execute a social engineering penetration test including phishing, |   vishing, smishing, and physical pretexting campaigns to measure human security resilience |   and identify training gaps. | domain: cybersecurity | subdomain: penetration-testing | tags: | - social-engineering | - phishing | - vishing | - pretexting | - GoPhish | - SET | - OSINT | - security-awareness | - red-team | version: '1.0' | author: mahipal \"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Conducting Social Engineering Penetration Test\n\n## Overview\n\nSocial engineering penetration testing assesses an organization's human attack surface through controlled simulation of real-world deception techniques. According to Verizon DBIR 2024, the human element is involved in approximately 68% of all breaches, with phishing remaining the dominant initial access vector. This skill covers phishing, vishing (voice phishing), smishing (SMS phishing), and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting social engineering penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Written authorization from senior management (CISO\u002FCTO)\n- Legal review confirming compliance with local laws (CFAA, GDPR, etc.)\n- Defined scope: target employee groups, attack types, exclusions\n- GoPhish server, domain for phishing infrastructure, VPS\n- OSINT tools: Maltego, theHarvester, LinkedIn scraping tools\n- Coordination with HR and Legal for employee notification post-test\n\n## Phase 1 — OSINT and Target Profiling\n\n### Employee Reconnaissance\n\n```bash\n# Email harvesting\ntheHarvester -d targetcorp.com -b all -l 500 -f harvester_results\n\n# LinkedIn OSINT (manual + tools)\n# Gather: names, roles, departments, email format\n# Identify: new hires, IT admins, finance team, executives\n\n# Email format discovery\n# Check: first.last@, flast@, firstl@\n# Verify with: hunter.io, phonebook.cz, email-checker.net\n\n# Social media OSINT\n# Twitter\u002FX: employees posting about work tools\u002Ffrustrations\n# Facebook: corporate event photos, office layout\n# GitHub: employee repos with corporate email addresses\n\n# Domain intelligence\ndig targetcorp.com MX +short\ndig targetcorp.com TXT +short\n# Check for SPF, DKIM, DMARC records\n# Weak DMARC = easier email spoofing\n\n# Check breach databases (authorized)\n# HaveIBeenPwned API for corporate emails\n# Identify employees with compromised credentials\n```\n\n### Target Selection Matrix\n\n| Group | Count | Pretext | Attack Vector |\n|-------|-------|---------|--------------|\n| Finance | 15 | Invoice approval | Phishing (credential harvest) |\n| IT Help Desk | 8 | Password reset | Vishing |\n| Executives | 5 | Board meeting update | Spear phishing |\n| New Hires (\u003C 90 days) | 12 | HR onboarding form | Phishing (payload) |\n| All Employees | 200 | IT security update | Broad phishing |\n\n## Phase 2 — Phishing Campaign\n\n### Infrastructure Setup\n\n```bash\n# Register lookalike domain\n# targetcorp.com -> targetc0rp.com, targetcorp-secure.com, targetcorp.net\n\n# Set up GoPhish server\nsudo apt install gophish\n# Edit config.json for admin and phishing server ports\ngophish\n\n# Configure sending profile in GoPhish\n# SMTP server: mail.attackdomain.com\n# From: it-security@targetcorp-secure.com\n# Headers: proper DKIM\u002FSPF for attack domain\n\n# Create landing page (credential harvesting)\n# Clone legitimate login page (Office 365, Okta, etc.)\n# GoPhish: Import Site -> https:\u002F\u002Flogin.microsoftonline.com\n# Enable: Capture Credentials, Capture Passwords\n# Redirect to real site after capture\n\n# Set up Evilginx for MFA bypass (authorized testing only)\nevilginx2\n: config domain attackdomain.com\n: config ipv4 \u003Cserver_ip>\n: phishlets hostname o365 login.targetcorp-secure.com\n: phishlets enable o365\n: lures create o365\n: lures get-url 0\n```\n\n### GoPhish Campaign Configuration\n\n```json\n{\n  \"campaign\": {\n    \"name\": \"IT Security Update - Q1 2025\",\n    \"template\": {\n      \"name\": \"Mandatory Security Training\",\n      \"subject\": \"Action Required: Complete Security Awareness Training by Friday\",\n      \"html\": \"\u003Chtml>...[branded email with urgency]...\u003C\u002Fhtml>\",\n      \"from\": \"IT Security Team \u003Csecurity@targetcorp-secure.com>\"\n    },\n    \"landing_page\": \"Office 365 Login Clone\",\n    \"sending_profile\": \"Phishing SMTP\",\n    \"groups\": [\"All Employees - Batch 1\"],\n    \"launch_date\": \"2025-03-10T09:00:00Z\",\n    \"send_by_date\": \"2025-03-10T12:00:00Z\"\n  }\n}\n```\n\n### Phishing Email Templates by Pretext\n\n**Template 1 — IT Security Update:**\n```\nSubject: [Action Required] Mandatory Password Reset - Security Incident\nFrom: IT Security \u003Csecurity@targetcorp-secure.com>\n\nDear {FirstName},\n\nOur security team has detected unauthorized access attempts on our systems.\nAs a precautionary measure, all employees must reset their passwords immediately.\n\nPlease click below to reset your password within the next 24 hours:\n\n[Reset Password Now] -> {phishing_url}\n\nFailure to comply may result in temporary account suspension.\n\nThank you,\nIT Security Team\n```\n\n**Template 2 — Finance Invoice:**\n```\nSubject: Invoice #INV-2025-4821 - Approval Required\nFrom: Accounts Payable \u003Cap@targetcorp-secure.com>\n\nHi {FirstName},\n\nPlease review and approve the attached invoice from our vendor.\nAmount: $47,250.00 | Due: March 15, 2025\n\n[View Invoice] -> {phishing_url}\n\nBest regards,\nAccounts Payable\n```\n\n## Phase 3 — Vishing Campaign\n\n### Call Script Template\n\n```\nPretext: IT Help Desk calling about suspicious login\n\nCaller: \"Hi, this is [Name] from the IT Help Desk. Am I speaking with [Target Name]?\"\n\n[Wait for confirmation]\n\nCaller: \"We've detected some unusual login activity on your account from an\nunrecognized location. For your protection, I need to verify your identity\nbefore we can investigate further.\"\n\nCaller: \"Can you confirm your employee ID and the email address associated\nwith your account?\"\n\n[Record responses]\n\nCaller: \"Thank you. I'm going to send you a verification link to confirm\nit's really you. Can you click on it and enter your credentials so we can\nsecure your account?\"\n\n[Send phishing link via email\u002FSMS during call]\n\nCaller: \"Great, I can see you've been verified. Your account is now secured.\nIf you notice any further issues, please call the help desk at [real number].\"\n```\n\n### Vishing Metrics to Track\n\n| Metric | Description |\n|--------|-------------|\n| Call answered | Target picked up the phone |\n| Engaged | Target continued conversation past initial question |\n| Information disclosed | Target provided credentials, employee ID, or PII |\n| Link clicked | Target clicked the verification link |\n| Credentials entered | Target entered credentials on phishing page |\n| Reported | Target reported the call to security |\n\n## Phase 4 — Physical Social Engineering\n\n### Physical Pretexting Scenarios\n\n```\nScenario 1: Delivery Person\n- Arrive with package labeled for executive\n- Request access to deliver personally\n- Attempt to tailgate through secure doors\n- Drop USB drives in common areas\n\nScenario 2: IT Vendor\n- Arrive with vendor badge (printed)\n- Claim scheduled maintenance on network closet\n- Attempt to access server rooms\n- Install rogue wireless AP if access gained\n\nScenario 3: New Employee\n- Arrive claiming first day orientation\n- Request temporary badge\n- Attempt to access restricted areas\n- Photograph sensitive screens\u002Fdocuments\n\nEvidence Collection:\n- Body camera (if legally permitted and authorized)\n- Photographs of accessed areas\n- WiFi probe from rogue AP\n- Notes on which doors\u002Fcheckpoints bypassed\n```\n\n## Phase 5 — Metrics and Analysis\n\n### Campaign Results Dashboard\n\n```\nPhishing Campaign Results:\n├── Emails Sent: 200\n├── Emails Delivered: 195 (97.5%)\n├── Emails Opened: 142 (72.8%)\n├── Links Clicked: 68 (34.9%)\n├── Credentials Submitted: 31 (15.9%)\n├── MFA Bypassed: 8 (4.1%)  [Evilginx]\n├── Reported to SOC: 12 (6.2%)\n└── No Action: 53 (27.2%)\n\nVishing Campaign Results:\n├── Calls Made: 23\n├── Calls Answered: 18 (78.3%)\n├── Engaged in Conversation: 15 (65.2%)\n├── Information Disclosed: 9 (39.1%)\n├── Credentials Provided: 4 (17.4%)\n└── Reported to Security: 2 (8.7%)\n\nPhysical Assessment:\n├── Tailgating Successful: 3\u002F5 attempts\n├── USB Drives Plugged In: 2\u002F10 dropped\n├── Restricted Areas Accessed: 2\u002F4 attempted\n└── Challenged by Employee: 1 time\n```\n\n### Risk Scoring\n\n| Attack Vector | Success Rate | Risk Level | Priority |\n|--------------|-------------|------------|----------|\n| Phishing (credential harvest) | 15.9% | High | P1 |\n| Vishing (info disclosure) | 39.1% | Critical | P1 |\n| Physical tailgating | 60% | High | P2 |\n| USB drop | 20% | Medium | P3 |\n| Spear phishing (exec) | 40% | Critical | P1 |\n\n## Phase 6 — Reporting and Recommendations\n\n### Remediation Priorities\n\n| Priority | Recommendation | Timeline |\n|----------|---------------|----------|\n| P1 | Deploy phishing-resistant MFA (FIDO2\u002FWebAuthn) | 30 days |\n| P1 | Implement targeted security awareness training | 14 days |\n| P1 | Deploy email gateway with URL rewriting | 30 days |\n| P2 | Strengthen physical access controls (mantraps, visitor badges) | 60 days |\n| P2 | Implement security champion program per department | 30 days |\n| P3 | Deploy USB device control policy | 30 days |\n| P3 | Establish phishing reporting button in email client | 14 days |\n\n## Tools Reference\n\n| Tool | Purpose |\n|------|---------|\n| GoPhish | Phishing campaign management platform |\n| Evilginx2 | MFA bypass via reverse proxy phishing |\n| Social Engineer Toolkit (SET) | Social engineering attack framework |\n| Maltego | OSINT and relationship mapping |\n| theHarvester | Email and domain OSINT |\n| King Phisher | Phishing campaign tool |\n| Modlishka | Reverse proxy for credential interception |\n\n## References\n\n- GoPhish: https:\u002F\u002Fgetgophish.com\u002F\n- Evilginx2: https:\u002F\u002Fgithub.com\u002Fkgretzky\u002Fevilginx2\n- Social Engineer Toolkit: https:\u002F\u002Fgithub.com\u002Ftrustedsec\u002Fsocial-engineer-toolkit\n- Verizon DBIR: https:\u002F\u002Fwww.verizon.com\u002Fbusiness\u002Fresources\u002Freports\u002Fdbir\u002F\n- NIST SP 800-61: Computer Security Incident Handling Guide\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Conducting Social Engineering Penetration Test\n\n## Overview\n\nSocial engineering penetration testing assesses an organization's human attack surface through controlled simulation of real-world deception techniques. According to Verizon DBIR 2024, the human element is involved in approximately 68% of all breaches, with phishing remaining the dominant initial access vector. This skill covers phishing, vishing (voice phishing), smishing (SMS phishing), and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting social engineering penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Written authorization from senior management (CISO\u002FCTO)\n- Legal review confirming compliance with local laws (CFAA, GDPR, etc.)\n- Defined scope: target employee groups, attack types, exclusions\n- GoPhish server, domain for phishing infrastructure, VPS\n- OSINT tools: Maltego, theHarvester, LinkedIn scraping tools\n- Coordination with HR and Legal for employee notification post-test\n\n## Phase 1 — OSINT and Target Profiling\n\n### Employee Reconnaissance\n\n```bash\n# Email harvesting\ntheHarvester -d targetcorp.com -b all -l 500 -f harvester_results\n\n# LinkedIn OSINT (manual + tools)\n# Gather: names, roles, departments, email format\n# Identify: new hires, IT admins, finance team, executives\n\n# Email format discovery\n# Check: first.last@, flast@, firstl@\n# Verify with: hunter.io, phonebook.cz, email-checker.net\n\n# Social media OSINT\n# Twitter\u002FX: employees posting about work tools\u002Ffrustrations\n# Facebook: corporate event photos, office layout\n# GitHub: employee repos with corporate email addresses\n\n# Domain intelligence\ndig targetcorp.com MX +short\ndig targetcorp.com TXT +short\n# Check for SPF, DKIM, DMARC records\n# Weak DMARC = easier email spoofing\n\n# Check breach databases (authorized)\n# HaveIBeenPwned API for corporate emails\n# Identify employees with compromised credentials\n```\n\n### Target Selection Matrix\n\n| Group | Count | Pretext | Attack Vector |\n|-------|-------|---------|--------------|\n| Finance | 15 | Invoice approval | Phishing (credential harvest) |\n| IT Help Desk | 8 | Password reset | Vishing |\n| Executives | 5 | Board meeting update | Spear phishing |\n| New Hires (\u003C 90 days) | 12 | HR onboarding form | Phishing (payload) |\n| All Employees | 200 | IT security update | Broad phishing |\n\n## Phase 2 — Phishing Campaign\n\n### Infrastructure Setup\n\n```bash\n# Register lookalike domain\n# targetcorp.com -> targetc0rp.com, targetcorp-secure.com, targetcorp.net\n\n# Set up GoPhish server\nsudo apt install gophish\n# Edit config.json for admin and phishing server ports\ngophish\n\n# Configure sending profile in GoPhish\n# SMTP server: mail.attackdomain.com\n# From: it-security@targetcorp-secure.com\n# Headers: proper DKIM\u002FSPF for attack domain\n\n# Create landing page (credential harvesting)\n# Clone legitimate login page (Office 365, Okta, etc.)\n# GoPhish: Import Site -> https:\u002F\u002Flogin.microsoftonline.com\n# Enable: Capture Credentials, Capture Passwords\n# Redirect to real site after capture\n\n# Set up Evilginx for MFA bypass (authorized testing only)\nevilginx2\n: config domain attackdomain.com\n: config ipv4 \u003Cserver_ip>\n: phishlets hostname o365 login.targetcorp-secure.com\n: phishlets enable o365\n: lures create o365\n: lures get-url 0\n```\n\n### GoPhish Campaign Configuration\n\n```json\n{\n  \"campaign\": {\n    \"name\": \"IT Security Update - Q1 2025\",\n    \"template\": {\n      \"name\": \"Mandatory Security Training\",\n      \"subject\": \"Action Required: Complete Security Awareness Training by Friday\",\n      \"html\": \"\u003Chtml>...[branded email with urgency]...\u003C\u002Fhtml>\",\n      \"from\": \"IT Security Team \u003Csecurity@targetcorp-secure.com>\"\n    },\n    \"landing_page\": \"Office 365 Login Clone\",\n    \"sending_profile\": \"Phishing SMTP\",\n    \"groups\": [\"All Employees - Batch 1\"],\n    \"launch_date\": \"2025-03-10T09:00:00Z\",\n    \"send_by_date\": \"2025-03-10T12:00:00Z\"\n  }\n}\n```\n\n### Phishing Email Templates by Pretext\n\n**Template 1 — IT Security Update:**\n```\nSubject: [Action Required] Mandatory Password Reset - Security Incident\nFrom: IT Security \u003Csecurity@targetcorp-secure.com>\n\nDear {FirstName},\n\nOur security team has detected unauthorized access attempts on our systems.\nAs a precautionary measure, all employees must reset their passwords immediately.\n\nPlease click below to reset your password within the next 24 hours:\n\n[Reset Password Now] -> {phishing_url}\n\nFailure to comply may result in temporary account suspension.\n\nThank you,\nIT Security Team\n```\n\n**Template 2 — Finance Invoice:**\n```\nSubject: Invoice #INV-2025-4821 - Approval Required\nFrom: Accounts Payable \u003Cap@targetcorp-secure.com>\n\nHi {FirstName},\n\nPlease review and approve the attached invoice from our vendor.\nAmount: $47,250.00 | Due: March 15, 2025\n\n[View Invoice] -> {phishing_url}\n\nBest regards,\nAccounts Payable\n```\n\n## Phase 3 — Vishing Campaign\n\n### Call Script Template\n\n```\nPretext: IT Help Desk calling about suspicious login\n\nCaller: \"Hi, this is [Name] from the IT Help Desk. Am I speaking with [Target Name]?\"\n\n[Wait for confirmation]\n\nCaller: \"We've detected some unusual login activity on your account from an\nunrecognized location. For your protection, I need to verify your identity\nbefore we can investigate further.\"\n\nCaller: \"Can you confirm your employee ID and the email address associated\nwith your account?\"\n\n[Record responses]\n\nCaller: \"Thank you. I'm going to send you a verification link to confirm\nit's really you. Can you click on it and enter your credentials so we can\nsecure your account?\"\n\n[Send phishing link via email\u002FSMS during call]\n\nCaller: \"Great, I can see you've been verified. Your account is now secured.\nIf you notice any further issues, please call the help desk at [real number].\"\n```\n\n### Vishing Metrics to Track\n\n| Metric | Description |\n|--------|-------------|\n| Call answered | Target picked up the phone |\n| Engaged | Target continued conversation past initial question |\n| Information disclosed | Target provided credentials, employee ID, or PII |\n| Link clicked | Target clicked the verification link |\n| Credentials entered | Target entered credentials on phishing page |\n| Reported | Target reported the call to security |\n\n## Phase 4 — Physical Social Engineering\n\n### Physical Pretexting Scenarios\n\n```\nScenario 1: Delivery Person\n- Arrive with package labeled for executive\n- Request access to deliver personally\n- Attempt to tailgate through secure doors\n- Drop USB drives in common areas\n\nScenario 2: IT Vendor\n- Arrive with vendor badge (printed)\n- Claim scheduled maintenance on network closet\n- Attempt to access server rooms\n- Install rogue wireless AP if access gained\n\nScenario 3: New Employee\n- Arrive claiming first day orientation\n- Request temporary badge\n- Attempt to access restricted areas\n- Photograph sensitive screens\u002Fdocuments\n\nEvidence Collection:\n- Body camera (if legally permitted and authorized)\n- Photographs of accessed areas\n- WiFi probe from rogue AP\n- Notes on which doors\u002Fcheckpoints bypassed\n```\n\n## Phase 5 — Metrics and Analysis\n\n### Campaign Results Dashboard\n\n```\nPhishing Campaign Results:\n├── Emails Sent: 200\n├── Emails Delivered: 195 (97.5%)\n├── Emails Opened: 142 (72.8%)\n├── Links Clicked: 68 (34.9%)\n├── Credentials Submitted: 31 (15.9%)\n├── MFA Bypassed: 8 (4.1%)  [Evilginx]\n├── Reported to SOC: 12 (6.2%)\n└── No Action: 53 (27.2%)\n\nVishing Campaign Results:\n├── Calls Made: 23\n├── Calls Answered: 18 (78.3%)\n├── Engaged in Conversation: 15 (65.2%)\n├── Information Disclosed: 9 (39.1%)\n├── Credentials Provided: 4 (17.4%)\n└── Reported to Security: 2 (8.7%)\n\nPhysical Assessment:\n├── Tailgating Successful: 3\u002F5 attempts\n├── USB Drives Plugged In: 2\u002F10 dropped\n├── Restricted Areas Accessed: 2\u002F4 attempted\n└── Challenged by Employee: 1 time\n```\n\n### Risk Scoring\n\n| Attack Vector | Success Rate | Risk Level | Priority |\n|--------------|-------------|------------|----------|\n| Phishing (credential harvest) | 15.9% | High | P1 |\n| Vishing (info disclosure) | 39.1% | Critical | P1 |\n| Physical tailgating | 60% | High | P2 |\n| USB drop | 20% | Medium | P3 |\n| Spear phishing (exec) | 40% | Critical | P1 |\n\n## Phase 6 — Reporting and Recommendations\n\n### Remediation Priorities\n\n| Priority | Recommendation | Timeline |\n|----------|---------------|----------|\n| P1 | Deploy phishing-resistant MFA (FIDO2\u002FWebAuthn) | 30 days |\n| P1 | Implement targeted security awareness training | 14 days |\n| P1 | Deploy email gateway with URL rewriting | 30 days |\n| P2 | Strengthen physical access controls (mantraps, visitor badges) | 60 days |\n| P2 | Implement security champion program per department | 30 days |\n| P3 | Deploy USB device control policy | 30 days |\n| P3 | Establish phishing reporting button in email client | 14 days |\n\n## Tools Reference\n\n| Tool | Purpose |\n|------|---------|\n| GoPhish | Phishing campaign management platform |\n| Evilginx2 | MFA bypass via reverse proxy phishing |\n| Social Engineer Toolkit (SET) | Social engineering attack framework |\n| Maltego | OSINT and relationship mapping |\n| theHarvester | Email and domain OSINT |\n| King Phisher | Phishing campaign tool |\n| Modlishka | Reverse proxy for credential interception |\n\n## References\n\n- GoPhish: https:\u002F\u002Fgetgophish.com\u002F\n- Evilginx2: https:\u002F\u002Fgithub.com\u002Fkgretzky\u002Fevilginx2\n- Social Engineer Toolkit: https:\u002F\u002Fgithub.com\u002Ftrustedsec\u002Fsocial-engineer-toolkit\n- Verizon DBIR: https:\u002F\u002Fwww.verizon.com\u002Fbusiness\u002Fresources\u002Freports\u002Fdbir\u002F\n- NIST SP 800-61: Computer Security Incident Handling Guide\n",{"hide":57,"name":5,"source":58,"license":15,"description":7,"authorized_lab":53,"origin_frontmatter":59},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: conducting-social-engineering-penetration-test | description: Design and execute a social engineering penetration test including phishing, |   vishing, smishing, and physical pretexting campaigns to measure human security resilience |   and identify training gaps. | domain: cybersecurity | subdomain: penetration-testing | tags: | - social-engineering | - phishing | - vishing | - pretexting | - GoPhish | - SET | - OSINT | - security-awareness | - red-team | version: '1.0' | author: mahipal ","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-conducting-social-engineering-penetration-test",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-10-27 02:18:29",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":57},[70,73,76],{"tool":71,"command":72},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-conducting-social-engineering-penetration-test",{"tool":74,"command":75},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-conducting-social-engineering-penetration-test",{"tool":77,"command":78},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-conducting-social-engineering-penetration-test","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-conducting-social-engineering-penetration-test\u002FSKILL.md",[],[82,106,130,157,183,201],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":52},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":52},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[113,114,93,115,116,117,118,119,120,121,122,99,123,101,124,125,126,127,128,129],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":139,"publishedAt":52},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[136],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[140,141,142,143,144,145,32,146,147,101,148,149,150,151,152,153,154,117,155,156],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":169,"publishedAt":52},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":167,"categoryName":168,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师",[170,103,171,140,93,172,173,174,117,175,176,177,178,179,180,181,182,48,99,101],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":52},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[190,191,192,193,194,195,196,197,198,101,37,124,199,200],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","agentic","user",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":217,"publishedAt":52},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[207,208,211,214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":209,"categoryName":210,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":212,"categoryName":213,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":215,"categoryName":216,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[218,219,220,101,124,221,93,222,118,99,223],"writing","writing skills","new","work","editing","Existing"]