shellcode-dev

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These GitHub repositories host open-source tools (Donut, sRDI, pe_to_shellcode, Amber) specifically designed to produce/pack PE files into shellcode and reflective loaders—legitimate for research but commonly used to create or distribute malware, so they are high-risk download sources despite being on GitHub.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document is explicit offensive malware tooling: it instructs how to build and hide shellcode, perform remote code injection and execution (CreateRemoteThread, APC, threadless/POOL/DRIP loaders, RWX section abuse, process forking), evade EDR (syscall unhooking, API hashing, PEB/EAT resolution), perform anti-analysis/fingerprinting, store payloads in PE certificate/registry/ADS, and implement polymorphic/metamorphic encoders—all clear indicators of deliberate backdoor/RCE and supply‑chain abuse capabilities.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt gives detailed, actionable instructions for creating and injecting shellcode, modifying process memory and protections, forking/creating remote threads, and altering PE/ DLL contents and system call stubs—actions that directly modify and compromise the host/other processes and bypass security controls.