apt-emulation

该技能与其“APT 模拟/红队方法论”目的基本一致，没有明显的凭据窃取或隐蔽外传设计，但它明确面向进攻性安全操作，且文档包含远程下载执行、agent 部署、未固定版本安装和 `--insecure` 配置等高风险模式。整体更像高风险攻防技能而非恶意窃密技能；应归类为高安全风险、低到中等恶意可能。

The fragment is red-team and detection-engineering documentation, not evident malware. It contains high-impact offensive examples and unsafe deployment practices: unauthenticated HTTP binary download and execution, insecure CALDERA mode, default credentials, LSASS dumping, and remote command execution. These are legitimate in tightly authorized isolated testing but create substantial security risk if copied into production or exposed infrastructure. No covert exfiltration, backdoor, or intentionally malicious payload is visible in this fragment.