CtrlK
BlogDocsLog inGet started
Tessl Logo

gophish-campaign

Build and launch a tracked phishing campaign with the GoPhish REST API — sending profile, groups, email template, landing page, launch, and event polling.

66

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

87%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and token-efficient with a clean six-step API flow, but it lacks explicit in-flow validation checkpoints for what is a batch sending operation, which is the main weakness.

Suggestions

Insert an explicit validation step between profile creation and launch (e.g., 'Send a single test email and confirm receipt before bulk launch') to satisfy the batch-operation feedback-loop requirement.

Add a checkpoint after launch to verify the campaign returned an ID and that results are pollable before walking away.

Fold the OPSEC rate-limit and pause guidance into the numbered flow as an inline gate rather than only as a trailing section.

DimensionReasoningScore

Conciseness

The body is lean — a brief orientation line, prerequisites, six complete curl commands, evidence, and OPSEC — with no padding or explanations of concepts Claude already knows; every token earns its place.

5 / 5

Actionability

Six copy-paste-ready curl commands with full JSON payloads cover the common cases end-to-end (SMTP profile, group, template, page, campaign launch, results polling).

5 / 5

Workflow Clarity

The six steps are clearly numbered and sequenced, but this is a batch send operation with no explicit validate-then-proceed checkpoint inside the flow (e.g., verify the sending profile with a test send, confirm the campaign returned an ID before launch), so the batch-operation cap of 3 applies.

3 / 5

Progressive Disclosure

A single-purpose skill organized into clear sections (Prerequisites, Flow, Evidence, OPSEC) with no nested references and no bundle files needed; the simple-skill organization exception applies.

5 / 5

Total

18

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, actionable, and well-differentiated, but it omits an explicit 'when to use' trigger clause, leaving the user without guidance on when to invoke this skill versus adjacent ones.

Suggestions

Append a 'Use when ...' clause naming the trigger situations (e.g., 'Use when launching a tracked phishing campaign with GoPhish, or when the user mentions GoPhish, phishing campaigns, or credential-harvest landing pages').

Add a couple of natural synonyms to broaden trigger matching (e.g., 'phishing simulation', 'send test phishing emails').

Mirror the metadata when_to_use terms into the description so the trigger guidance is visible without metadata inspection.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'sending profile, groups, email template, landing page, launch, and event polling' — giving comprehensive coverage of the GoPhish workflow rather than a single generic verb.

5 / 5

Completeness

The 'what' is clear ('Build and launch a tracked phishing campaign with the GoPhish REST API'), but there is no 'Use when...' clause or equivalent trigger guidance in the description, which caps completeness at 3.

3 / 5

Trigger Term Quality

Natural terms like 'phishing campaign', 'GoPhish', 'email template', 'landing page', and 'event polling' are present and would be said by users, but a few common synonyms are absent.

4 / 5

Distinctiveness Conflict Risk

The 'GoPhish REST API' phishing-campaign niche is highly specific with distinct triggers and minimal overlap risk against other skills.

5 / 5

Total

17

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.