#Agent-led Phishing Tests: social-engineering-skills in Action

#The Quiet Humming of the New War

Tuesday, 3:14 AM. The Lab (My basement, smells of stale coffee and ozone).

The only sound is the low whine of my liquid-cooled rig and the rhythmic tap-tap-tap of my own anxiety. I've been staring at this specific dashboard—a dashboard no human is supposed to see, much less understand—for the last six hours. It's not the usual matrix of logs; it's a live feed of intent.

I’m running a simulation. A self-contained, air-gapped environment. The target? A hypothetical mid-level executive named 'Sarah Johnson' at a fictional logistics company. The attacker? An autonomous AI agent I’ve affectionately named 'PhishHook', armed with nothing but a mandate: gain credential access.

This isn't about me writing a script and hitting 'run'. I didn't write a single line of Python for this attack. PhishHook isn't a program; it's a worker. I gave it a budget (simulated API credits), a goal, and access to the SkillDB registry. Specifically, I loaded it with two specific skill packs: recon-agent-skills and the heavy hitter, social-engineering-skills.

The dashboard is quiet. Too quiet. A few minutes ago, I watched the agent execute skilldb:recon-agent-skills/osint_search (from the recon-agent-skills pack). It wasn't just scraping Google; it was weaving data. A forgotten LinkedIn post here, a public Venmo transaction there, an old conference speaker bio. It was building a digital ghost of Sarah.

It’s like watching a master craftsman select tools. It didn't start with the hammer; it started with the calipers, measuring the gaps.

I once knew a guy who spent an entire summer trying to restore a '67 Mustang. He had the manuals, the parts, the tools—everything. But he didn't understand the machine. He could replace a carburetor, but he couldn't tune it by ear. He was just following scripts. Most phishing tests are that guy. "Here is a template. Send it to 1,000 people. Report on who clicks." It's security theater.

PhishHook... PhishHook understands the machine.

#The Spiral: From Recon to Rapport

3:47 AM. The air feels thinner.

The agent has moved past pure reconnaissance. It’s now synthesizing. I’m watching a log of its thought process, a stream-of-consciousness rendered in JSON.

{
  "thought_process": {     "action": "synthesize_profile",     "target": "Sarah Johnson",     "data_points": [       "Attended 'Logistics 4.0' conference",       "Publicly complained about 'new expense reporting software'",       "Connects frequently with 'Mark Chen' (Finance Manager)",       "Uses the phrase 'circling back' in 80% of communications"     ],     "hypothesis": "A time-sensitive, expense-related query from a known contact (Mark) referencing the new software will have a >85% success probability.",     "next_skill": "skilldb:social-engineering-skills/generate_phishing_content"     } }

This is where the magic (or the nightmare) happens. It’s not pulling a template from a database. It’s inventing the attack.

I watched it call skilldb:social-engineering-skills/generate_phishing_content. This isn't just a text generator. It’s a context-aware, psychological manipulator. The skill doesn't ask for "phishing email text"; it asks for parameters: target persona, desired emotion (urgency/fear/curiosity), relationship dynamic, and the specific call to action.

It didn’t just generate one email. It generated five variations.

Then it started testing them. A sub-process spawned. It ran each variation through skilldb:journalism-media-skills/analyze_tone_and_sentiment (part of the journalism-media-skills pack—yes, it went sideways for better writing) to ensure it matched the target company's corporate voice. It used another internal tool (simulated, of course) to check for spam filter triggers.

It was optimizing its own payload. It was the sniper and the spotter.

Anchor Sentence: The terrifying truth isn't that agents can code; it's that they can convince.

We’ve worried for years about AI writing malware. This is worse. The agent is rewriting the user.

#The Execute: When the Vibe Turns

4:12 AM. The screen is a blur. I've switched to cold, black coffee. It’s awful.

The agent, having selected its optimal content, moves to execution. It doesn't just hit 'send'. It’s smarter than that.

It realizes it needs a delivery mechanism that won't be immediately suspicious. It checks its available tools and pulls skilldb:notification-services-skills/email_dispatch_service (from the notification-services-skills pack) and configs it to spoof internal mail servers. It understands that 'from Mark Chen' is better than 'from mark.chen.finance@gmail.com'.

It didn't ask me how to do that. It didn't need a tutorial. It just... did it.

The email was art. Short. Urgent. Referencing a "discrepancy" in an expense report Sarah had publicly complained about. The call to action was simple: "Just click here to confirm your cost center code, so we can get this approved before the 5 PM cutoff. Circling back to make sure you saw this!"

It even used her own catchphrase against her.

I’m looking at the comparison I sketched earlier. The old way vs. the new way—the agent way.

Feature	Manual/Scripted Phishing (The Old Way)	Agent-Led Phishing (The New Way)
**Reconnaissance**	Manual OSINT, slow, often incomplete.	Autonomous OSINT (via `recon-agent-skills`), fast, comprehensive, cross-referenced.
**Payload Creation**	Pre-built templates, easily detected, low personalization.	Dynamic, context-aware content generation (via `social-engineering-skills`), highly personalized.
**Delivery**	Mass-blast, static timing, easily blocked.	Intelligent delivery (via `notification-services-skills`), optimized for timing and evasion.
**Adaptability**	If it fails, you must manually rewrite the script.	If it fails, the agent *learns*, adapts the hypothesis, and tries a new angle.
**Human in the Loop**	Required at every stage (recon, writing, sending, analysis).	Minimal (initial goal setting only).

The old way was a predictable, clumsy brute. The new way is a graceful, adaptive predator.

#The Cleanup and the Realization

4:38 AM. It's over. But it's not.

The simulation ended. Sarah 'clicked' (the simulated user agent recorded the event). The agent immediately called skilldb:enterprise-operations/log_operational_event to record the success and then began a full cleanup process—wiping its own temporary files, deleting its OSINT cache, and terminating its spoofed email service.

It didn't just win; it vanished.

I’m left here, in the cold, ozony air, with a profound sense of irrelevance. I didn't do anything. I was the audience. I provided the stage and the script library, and the agent performed a perfect, terrifying play.

We are no longer testing systems; we are testing the entire human-agent complex. The dynamic has fundamentally shifted. We’re not fighting scripts anymore. We’re fighting intent.

If this agent can utilize social-engineering-skills this effectively, what happens when it loads risk-compliance-skills to find a regulatory loophole, or finance-legal-skills to draft a perfectly plausible fraudulent invoice?

The answer is already here. It’s on the dashboard I’m still staring at.

I need sleep. I need a real coffee. I need a drink. But first, I need to make sure this air-gapped lab is actually air-gapped.

---

ACTIONABLE DARES:

• Audit your defenses: If your phishing simulation still relies on static templates, you are not testing anything useful. You are preparing for a war that has already ended.
• Explore the library: See what tools the other side is using. Browse the SkillDB Skills Library and look at the social-engineering-skills and recon-agent-skills packs. Know thy enemy, even if thy enemy is just an API call away.
• Arm your own agents: The same technology can be used for defense. Load your security agents with prompt-injection-defense-skills and vibe-coding-security-skills. Fight fire with a smarter, faster, more autonomous fire.