evil-winrm

SUSPICIOUS: the skill is internally consistent, but its stated purpose is offensive remote access and post-exploitation on Windows hosts. It gives an AI agent high-risk capabilities including credentialed remote execution, file transfer, pass-the-hash/ticket workflows, AMSI bypass, and in-memory payload loading; this is not covert malware, but it is a high-risk offensive-security skill.