windows-mitigations-bypass

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Yes — the list includes multiple offensive/security-bypass GitHub repositories, exploit/dumper tools, vulnerable-driver databases and even an explicit attacker payload URL, all high‑risk resources commonly used to host or distribute malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository is explicit offensive tooling: it documents and provides scripts to bypass Windows mitigations (AMSI/ETW/ASR/WDAC/ACG/CIG/CET), blind telemetry, dump and exfiltrate LSASS credentials (PPL/LSA bypass, PPLBlade/nanodump), load vulnerable signed drivers for kernel R/W (BYOVD) and strip protections, and find/weaponize CFG/CET/ASLR weaknesses — clearly intended to enable credential theft, remote code execution, backdoors, and other malicious post‑exploitation actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to run scripts and commands that disable or bypass Windows security controls (AMSI/ETW/WDAC/ASR, PPL/LSA, VBS/HVCI), patch in-memory code, dump/modify protected processes, and manipulate drivers/boot configuration—actions that modify system state and require elevated/sudo-like privileges, so it clearly pushes the agent to compromise the host.