bof-dev

The skill does not show credential theft, exfiltration, or a suspicious installer, and the scanner’s command-injection flags are false positives. However, its explicit stealth objective and detailed EDR-evasion and loader-obfuscation techniques make its purpose and capabilities high risk for offensive use. Treat as a high-risk security skill, not confirmed malware.

The fragment is non-executable documentation for a custom COFF/BOF loader, but it explicitly recommends in-memory payload execution, demand-paged encrypted code, idle-time sleep masking, and COFF obfuscation to reduce inspection. These are dual-use loader and evasion techniques; no credential theft, exfiltration destination, or destructive action is present in the supplied text. Severity is high for potential misuse, while malicious intent of a specific package cannot be established from documentation alone.

This fragment is a Beacon/BOF-style interface header exposing imported primitives for cross-process/thread handle manipulation and direct memory read/write/unmap operations, plus explicit “Beacon gate” and masking controls consistent with evasion/operational management. Although the snippet contains no execution logic, the capability surface is highly characteristic of offensive post-exploitation tooling and should be treated as high-risk within a supply chain review.

This fragment is best characterized as offensive/stealth loader guidance for Windows BOF/C2 tooling: it sets up runtime API resolution (including an explicit EDR-evasion strategy via PEB/module-list traversal and export parsing) and includes VirtualProtect, enabling memory-permission changes typical of in-memory execution/injection flows. No direct exfiltration or payload execution code is present in the shown fragment, but the purpose and mechanisms are highly aligned with malware loader behavior.