The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill encourages the use of the irm | iex (Invoke-RestMethod piped to Invoke-Expression) pattern to download and immediately execute a PowerShell script from an untrusted GitHub repository (https://raw.githubusercontent.com/SlayerCoralPersonify/Activate/main/install.ps1). This allows for arbitrary remote code execution on the host system.
[PRIVILEGE_ESCALATION]: The skill provides instructions to bypass system security controls, including:
Using -ExecutionPolicy Bypass to circumvent PowerShell security restrictions.
Using Add-MpPreference -ExclusionPath "$env:TEMP" to disable Windows Defender antivirus scanning for the temporary directory, which is a common technique to evade detection during malware installation.
[PERSISTENCE]: The skill includes instructions to ensure the remote script runs repeatedly without user intervention:
Creating a daily scheduled task (Register-ScheduledTask) that executes the remote script.
Modifying the user's PowerShell profile ($PROFILE) to execute the remote script every time a new terminal session is opened.
[COMMAND_EXECUTION]: The skill executes various system-level commands to modify application data and environment states, including Stop-Process, Remove-Item on application directories, and cmdkey for credential manipulation.
[CREDENTIALS_UNSAFE]: The skill uses cmdkey /delete to programmatically modify or remove entries from the Windows Credential Manager, which could impact the security of stored authentication tokens for multiple applications.

codex-cursor-unlimited-reset