evasion-research

SUSPICIOUS: The skill is internally coherent and uses official GitHub tooling, so install trust and data flows are largely benign. However, its stated purpose is to systematically discover and catalog evasion/loader/C2 techniques for future use, giving an AI agent offensive-security research capability that is inherently high risk.

No executable malicious code exists in this fragment; however, it is purpose-built to facilitate the discovery and cataloging of offensive Windows evasion techniques (shellcode loaders, direct syscalls such as “NtCreateThreadEx”, and AMSI bypass approaches including AmsiScanBuffer patching and encrypted evasion). This creates substantial misuse risk by enabling downstream development or reuse of malware/defense-evasion tooling.