shellcode-fluctuation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The repository contains source and build instructions for evasion techniques (shellcode encryption/fluctuation) and integration with Cobalt Strike, i.e., explicit offensive/malware capabilities, making it a high-risk distribution source.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). Deliberately malicious: implements in-memory XOR encryption of injected shellcode, toggles page protections and advocates syscall stubs and Cobalt Strike integration to evade EDRs — enabling obfuscated remote code execution/backdoor persistence.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs how to embed and execute shellcode, modify in-memory page protections, and use direct syscalls to evade EDR—i.e., it directs bypassing security mechanisms and active compromise of the host.