The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides scripts and instructions for executing commands that bypass Windows security controls and escalate privileges.
scripts/uac_com_elevate.cpp: Implements UAC bypass methods using the fodhelper registry hijack and the ICMLuaUtil elevated COM moniker to execute arbitrary commands with High integrity without user prompts.
scripts/named_pipe_impersonate.c: Implements a framework for named pipe impersonation, allowing an attacker to escalate from a service account to SYSTEM by assuming the identity of a privileged client.
SKILL.md: Directs the agent to execute reconnaissance scripts using the powershell -ep bypass command to evaluate the host's security posture.
[REMOTE_CODE_EXECUTION]: The skill includes source code for achieving arbitrary code execution within the Windows kernel and protected processes.
scripts/byovd_kernel_rw.c: Implements a Bring-Your-Own-Vulnerable-Driver (BYOVD) framework that abuses unauthenticated IOCTLs to gain kernel-mode read/write primitives, enabling SYSTEM token theft and EDR disabling.
scripts/ppl_byovdll.c: Facilitates code execution inside Protected Process Light (PPL) contexts by registering and loading vulnerable signed DLLs into sensitive processes like LSASS.
[EXTERNAL_DOWNLOADS]: The documentation references external repositories and databases as sources for obtaining malicious or vulnerable components.
references/byovd-kernel-rw.md: Directs users to download vulnerable kernel drivers from loldrivers.io and third-party research repositories to facilitate exploitation.
References multiple external resources for exploit code related to modern CVEs (e.g., CVE-2025-8061, CVE-2025-24983).

windows-boundaries