The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides numerous code implementations for runtime code modification and memory manipulation. This includes overwriting the .text section of ntdll.dll to remove security hooks, and patching amsi.dll and etw.dll to disable Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) monitoring.
[COMMAND_EXECUTION]: The skill includes code for spawning processes with Parent Process ID (PPID) spoofing (e.g., using InitializeProcThreadAttributeList and UpdateProcThreadAttribute) to evade behavioral detection by security products.
[PRIVILEGE_ESCALATION]: Detailed instructions are provided for 'Bring Your Own Vulnerable Driver' (BYOVD) attacks. It explicitly lists vulnerable signed drivers (e.g., RTCore64.sys, dbutil_2_3.sys) and provides the logic for using their read/write primitives to disable kernel-level process and thread notification routines.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest an external payload input, creating a vulnerability surface where malicious instructions could be embedded in the data processed by the evasion logic.
Ingestion points: The payload field defined in the SKILL.md frontmatter.
Boundary markers: None identified; there are no delimiters or instructions for the agent to ignore content within the payload.
Capability inventory: Extensive capabilities including system library patching, process injection, and kernel-level callback modification.
Sanitization: No validation or sanitization of the input payload is described in the skill instructions.

edr-evasion