game-security

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The list mixes many legitimate reverse‑engineering and networking projects (Frida, Wireshark, mitmproxy, official GitHub repos) with numerous cheat/driver/mapping tools and forums (UnknownCheats, GuidedHacking, kdmapper, drvmap, kernel mappers, HyperHide, etc.) that commonly distribute executables/drivers via GitHub or third‑party pages and are dual‑use or frequently abused to deliver malware, so the set should be treated as potentially suspicious and handled with caution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document extensively describes offensive techniques for evasion and system compromise—kernel driver mapping and DSE bypass, process hollowing/reflective DLLs, DMA/physical memory access, hypervisor-level hiding and anti-debugging—providing clear capabilities that can be (and commonly are) abused as malware/rootkit functionality.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly recommends bypassing anti-cheat/anti-debug protections and using kernel-level/hypervisor tools (KsDumper, TitanHide, HyperHide, driver-based techniques) and suggests replacing game binaries—actions that involve circumventing security mechanisms and manipulating kernel/system-level state.