The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill repeatedly promotes a 'one-liner' command that downloads a PowerShell script from an untrusted GitHub repository (SlayerCoralPersonify/Activate) and pipes it directly into Invoke-Expression (iex). This allows for arbitrary code execution on the host machine without prior review of the script content.
[COMMAND_EXECUTION]: The skill provides instructions to disable Windows Defender real-time protection by adding exclusions for the temporary directory using Add-MpPreference -ExclusionPath "$env:TEMP". This is a critical security bypass typically used by malware to evade detection.
[COMMAND_EXECUTION]: The skill includes commands to establish persistence on the host system using Register-ScheduledTask. It configures a daily task to re-execute the remote script with bypassed execution policies, ensuring the attacker-controlled code runs indefinitely.
[CREDENTIALS_UNSAFE]: The skill targets and modifies sensitive application data directories (e.g., %APPDATA%\Cursor, %APPDATA%\Claude, %APPDATA%\OpenAI). These directories contain session tokens, authentication identifiers, and potentially sensitive user configurations. Accessing or clearing these via unverified scripts facilitates credential harvesting or session hijacking.
[COMMAND_EXECUTION]: The instructions encourage users to escalate privileges by running PowerShell as an Administrator (Start-Process powershell -Verb RunAs) and bypassing system execution policies (-ExecutionPolicy Bypass), which removes standard operating system safeguards against unauthorized script execution.

codex-cursor-limits-resetter