stack-spoofing-dev
Warn
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [OBFUSCATION]: The skill is entirely dedicated to 'Stack Spoofing,' a technique used to create deceptive call stacks. This is an evasion mechanism designed to mislead Endpoint Detection and Response (EDR) tools and stack-walking security monitors by providing a fake execution history.
- [DYNAMIC_EXECUTION]: Provides functional assembly-language templates for C, Rust, and Go that perform low-level manipulation of the CPU stack pointer (RSP) and register state. These 'trampolines' allow for the dynamic redirection of execution flow and the planting of synthetic return addresses.
- [EXTERNAL_DOWNLOADS]: Directs users to several third-party, non-vetted GitHub repositories and crates (e.g., klezVirus/Moonwalk--, NtDallas/Draugr, and the 'unwinder' Rust crate) that provide offensive tools for stack masquerading and security bypass.
- [COMMAND_EXECUTION]: Facilitates the execution of system calls through 'indirect syscall' dispatchers and context-replay mechanisms, which effectively hides the origin of the commands being executed from operating system monitoring hooks.
Audit Metadata