webshell-deploy

SUSPICIOUS。该 skill 与其声明目的基本一致，但声明目的本身就是教 AI 代理部署 webshell、绕过上传限制、注入内存马并维持远程命令执行，属于高风险攻击/利用能力。未见凭证窃取、第三方中转或恶意安装链，因此不属已确认 malware；但作为 AI Agent Skill，它使代理能够执行现实世界攻击与持久化操作，安全风险很高。

该文本明确描述并提供可直接部署的 JSP/PHP Webshell、任意命令执行后门、恶意文件上传、WAF/AV 绕过以及 Tomcat PUT 写入利用流程。其输入到命令执行和文件写入的流向清晰，未发现合法应用场景下的安全约束。应将其视为高概率恶意攻击工具内容，不应部署、执行或加入软件包。

The provided fragment is clear webshell and in-memory backdoor code, not merely a potentially unsafe implementation. It executes attacker-supplied operating-system commands, captures their output, dynamically installs request handlers, and documents several methods for injecting and hiding similar payloads. It should be treated as malicious and removed or isolated; the surrounding file should be investigated for the source of `cmd`, trigger endpoints, and deployment history.