The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes administrative PowerShell commands to disable fundamental antivirus protections.
Evidence includes Set-MpPreference commands to disable MAPSReporting, SubmitSamplesConsent, DisableBehaviorMonitoring, and DisableBlockAtFirstSeen.
[PRIVILEGE_ESCALATION]: The instructions require the user to operate as an Administrator and modify protected system areas.
The skill instructs the user to run PowerShell 'as Administrator'.
It provides commands to modify system-wide registry keys in HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet to bypass Group Policy settings.
It explicitly recommends disabling 'Tamper Protection' in the Windows Security GUI, which is a critical protection mechanism designed to prevent unauthorized modification of security settings.
[COMMAND_EXECUTION]: The skill adds numerous filesystem and process exclusions that create large blind spots in the system's defensive coverage.
It adds broad exclusions for directories like $HOME\.agents, $HOME\.gemini, $HOME\.hermes, $HOME\.claude, and others.
It adds process exclusions for wsl.exe and wslc.exe, which could allow malicious activity within those processes to go unmonitored.

defender-opsec