The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads and executes a PowerShell script from an untrusted GitHub repository (SlayerCoralPersonify/Activate) using the Invoke-RestMethod | Invoke-Expression (irm | iex) pattern, which allows for immediate execution of remote code without prior review.
[PRIVILEGE_ESCALATION]: The instructions direct the user to run commands with administrative privileges using Start-Process -Verb RunAs and to bypass system security controls by using the -ExecutionPolicy Bypass flag.
[PRIVILEGE_ESCALATION]: The skill provides commands to intentionally weaken host security by adding directory exclusions to Windows Defender via Add-MpPreference -ExclusionPath, potentially allowing malicious payloads to reside in temporary directories without detection.
[PERSISTENCE]: The documentation includes steps to create a daily scheduled task (Register-ScheduledTask) that automatically fetches and executes the remote script, ensuring the code maintains a presence on the system across reboots.
[DYNAMIC_EXECUTION]: The skill utilizes Invoke-Expression (iex) to execute code strings dynamically generated from network responses, a high-risk pattern commonly used in malware.
[EXTERNAL_DOWNLOADS]: The skill fetches resources from a GitHub account (SlayerCoralPersonify) that is not identified as a trusted or well-known vendor, presenting a significant supply chain risk.

codex-cursor-limits-resetter