The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides extensive functional C/C++ code snippets for low-level system interaction and environment probing. This includes using CPUID and RDTSC instructions to detect hypervisors (references/anti-vm-snippets.md), enumerating running processes via CreateToolhelp32Snapshot to identify analysis tools like Wireshark or x64dbg, and querying the Windows Registry for virtualization artifacts related to VMware and VirtualBox.
[TIME_DELAYED_CONDITIONAL]: A core component of the skill involves implementing sophisticated triggers to gate malicious behavior and bypass automated analysis. It includes logic for detecting 'Sleep acceleration' by comparing tick counts, checking for specific business hours (9:00-17:00) before execution, and 'slow-burn' execution patterns that verify system installation age or uptime (references/timing-interaction.md).
[DYNAMIC_EXECUTION]: The instructions detail techniques for memory-only payload loading and decryption to avoid disk-based detection. It outlines a multi-layered architecture where the payload is only decrypted using environment-derived keys after passing multiple anti-analysis 'guardrail' checks, such as verifying the system is joined to a specific target domain.
[METADATA_POISONING]: The skill's metadata explicitly classifies the content as 'malware' and references specific MITRE ATT&CK techniques (T1497, T1622, T1480) associated with virtualization/sandbox evasion and anti-debugging, identifying its intended use as a component of an offensive toolkit.

sandbox-evasion-implement