The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is primarily designed to generate and execute shellcode at runtime. It provides templates and a component database for various execution methods, including direct function pointer calls, thread creation, fibers, and over 40 different Windows callback mechanisms (e.g., EnumWindows, SetTimer, APC).
[REMOTE_CODE_EXECUTION]: The component library (loader-components-db.json) includes functionality to download shellcode from remote URLs at runtime using Windows networking APIs like WinHttp and InternetOpen, which allows for secondary payload delivery.
[OBFUSCATION]: The skill provides numerous methods to hide shellcode and bypass string-based detection. This includes encoding payloads as UUIDs, IPv4 addresses, MAC addresses, or English wordlists, as well as applying XOR, RC4, or RSA encryption. The AGENT.md explicitly instructs the agent to never include plain-text strings like 'shellcode' or 'payload' in the generated code.
[PRIVILEGE_ESCALATION]: The skill includes techniques for process injection and cross-process execution, such as VirtualAllocEx, CreateRemoteThread, SetThreadContext (process hollowing), and Module Stomping. These techniques are used to execute code within the context of other, potentially more privileged, processes.
[EXTERNAL_DOWNLOADS]: The loader-components-db.json file contains numerous references to third-party GitHub repositories for malware loaders and evasion techniques (e.g., 0xHossam/HuffLoader, b1nhack/rust-shellcode, f1zm0/hades). These sources are not recognized as trusted and may contain malicious content.
[COMMAND_EXECUTION]: The skill instructs the agent to use local shell commands (bash) to perform cross-compilation using mingw-gcc, g++, and cargo to verify the generated malicious loaders.
[DETECTION_EVASION]: The skill explicitly focuses on bypassing security controls (AV/EDR) by using native NT syscalls (NtAllocateVirtualMemory, NtCreateThreadEx) to circumvent user-mode hooks, and includes 'evasion scenarios' with anti-debugging and anti-sandbox logic.

shellcode-loader-generate