shellcode-loader-generate

SUSPICIOUS. The skill is internally consistent and uses mostly local, standard build tooling, but its entire purpose is to help an AI agent generate and compile shellcode loaders, injection methods, and evasion techniques. That makes it a high-risk offensive-security skill even without evidence of credential theft or malicious installer behavior inside the skill itself.

该片段提供将 shellcode 复制到 Windows 可执行内存并运行的 loader 模板，并列出多种替代执行机制；实际 payload 未提供。没有观察到网络通信、凭据收集、持久化或破坏行为，因此不能据此确认该片段本身包含恶意软件。它具备直接运行任意 shellcode 的能力，安全风险较高，应仅在授权环境中使用。

High likelihood of malicious intent. The code fragment is a repository of Windows offensive techniques to execute shellcode and perform injection/hijacking (e.g., remote thread creation, process hollowing via RIP modification, module stomping, APC/fiber/timer/callback execution, VEH-triggered execution). Even though no explicit credential theft or network exfiltration appears in the excerpt, it provides direct arbitrary code execution mechanisms typical of malware. Recommend treating the package as extremely dangerous and not using it in production.

This fragment strongly matches a malicious Windows in-memory loader/evasion configuration: it describes embedded encrypted payloads (XOR/RC4), executable memory allocation (VirtualAlloc/HeapCreate), byte copying (memcpy), multiple indirect execution mechanisms (callback/APC/Fiber/function-pointer), and explicit anti-debugging/sandbox checks plus ETW bypass and stealthy API resolution. Even without the surrounding code, the enumerated primitives and evasion details are highly indicative of malware capability rather than benign dependency logic.

This configuration is a strong malicious-intent blueprint: it instructs generation of Windows in-memory shellcode loader code that allocates executable memory (RWX), copies payload bytes, and executes them via thread or fiber mechanisms, with added stealth/evasion guidance. While not operational code itself, it meaningfully enables malware development and should be treated as high risk in a software supply-chain context.

This fragment does not contain executable malware, but it is explicitly designed to steer an LLM/agent toward locating methodology for generating a Windows shellcode loader intended to bypass Windows Defender. The presence of offensive in-memory execution keywords (e.g., VirtualAlloc/CreateThread) and an evasion objective makes the overall intent highly suspicious. Validate the surrounding skill/orchestrator implementation for actual payload-generation or evasion behavior; do not treat this configuration as benign.