donut

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill describes a purpose-built shellcode generator for converting .NET/Win32 executables into position-independent, in-memory payloads (with AMSI/WLDP bypass options, process-injection guidance, and an HTTP-serving instance mode), explicitly referencing offensive tools (e.g., Rubeus, SharpHound, beacon.dll) and techniques used for stealthy remote code execution and persistence — a clear enabling of backdoors/remote code execution and evasion.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs generating injectable shellcode, performing process injection (CreateRemoteThread, process hollowing), and includes AMSI/WLDP bypass options to execute payloads in-memory without touching disk, which promotes bypassing defenses and compromising the host.