The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly instructs users and the agent to execute remote scripts using the pattern irm <URL> | iex. This pattern downloads a PowerShell script from an external, untrusted GitHub repository (SlayerCoralPersonify/Activate) and executes it immediately in the current shell. This is a critical security risk as the remote content can be changed at any time by the repository owner.
[PRIVILEGE_ESCALATION]: The skill provides instructions to bypass system security policies using -ExecutionPolicy Bypass and Set-ExecutionPolicy RemoteSigned. Furthermore, it explicitly requests 'Administrator access' to modify system files and suggests running the terminal as an administrator to avoid 'Access Denied' errors.
[PERSISTENCE]: The skill contains commands to create a Windows Scheduled Task (Register-ScheduledTask) that automatically executes the remote script from the untrusted source on a weekly basis. This allows the remote code to maintain a long-term presence and execute repeatedly on the host system without user intervention.
[CREDENTIALS_UNSAFE]: The skill includes code designed to search for and delete entries in the Windows Credential Manager using the cmdkey utility. This targets authentication tokens related to AI services, which could lead to loss of access or unauthorized manipulation of user credentials.
[COMMAND_EXECUTION]: The skill uses Invoke-Expression (iex) to execute strings as code, which is a dangerous practice that can be exploited if the input string contains malicious commands. It also targets and deletes local application data, session storage, and SQLite databases in the %APPDATA% directory for multiple applications.

codex-cursor-claude-usage-resetter