The Agent Skills Directory

[COMMAND_EXECUTION]: Provides implementation templates for advanced process injection techniques, including process hollowing, module stomping, and threadless callback injection to execute code in remote processes.
[PRIVILEGE_ESCALATION]: Includes specific assembly stubs for memory-patching security components, such as overwriting AmsiScanBuffer and NtTraceEvent to suppress antivirus alerts and Event Tracing for Windows (ETW) logs.
[OBFUSCATION]: Contains multiple templates for metamorphic encoding, rolling XOR, and Mixed Boolean Arithmetic (MBA-XOR) designed to hide payload intent from signature-based scanners.
[DYNAMIC_EXECUTION]: Implements position-independent code (PIC) patterns and self-modifying assembly stubs (e.g., ADFL) to enable the runtime execution of shellcode in memory.
[TIME_DELAYED_CONDITIONAL]: Features anti-analysis logic, including RDTSC timing checks to detect single-stepping and CPUID-based hypervisor detection to identify virtualized or sandbox environments.
[PERSISTENCE]: Documents methods for masquerading as signed system modules (Phantom DLL) to maintain a stealthy presence on a host system.
[INDIRECT_PROMPT_INJECTION]: As a framework for executing low-level instructions, it presents a significant surface for data-driven instruction execution via its PIC and shellcode implementation stubs.
Ingestion points: Processes assembly source and encoded payload bytes in stubs like assets/decoder-stubs.asm.
Boundary markers: Absent; code is designed for direct low-level execution.
Capability inventory: Full range of system calls, memory modification, and execution flow redirection.
Sanitization: None; the skill is designed to decode and execute raw instruction streams.

asm-offensive-patterns