reverse-skill-router

SUSPICIOUS. The skill is internally aligned with offensive security and reverse-engineering, so the dangerous capabilities generally fit its stated purpose. However, it is a high-risk router that mandates immediate script execution, broad downstream tool use, and bootstrap of external security tooling; this creates substantial execution and supply-chain exposure even without clear evidence of credential theft or covert exfiltration in the provided text.

No direct, explicit malware indicators (e.g., keylogging, exfiltration to unknown domains, reverse shells) are visible in this fragment. However, the script is a high-privilege supply-chain installer that downloads and installs third-party components and executes manifest-driven scripts with -ExecutionPolicy Bypass. It does enforce SHA256 integrity when a pinned digest is available, but continues with only a warning when no pinned digest exists. If the local bootstrap manifests/definitions are tampered with, this could lead to arbitrary code execution and malicious tool installation. Overall: likely intended functionality, but elevated supply-chain risk requiring strict pinning/verification of manifests and digests.

The provided “code” is actually analyst-style evasion/instrumentation-bypass notes, describing anti-debug/anti-Frida/root/emulator/VM detection circumvention and signature-check removal. No executable logic, data inputs, or concrete sinks (network/file/credential theft/persistence) are present in this fragment, so supply-chain malware cannot be confirmed here. If these notes correspond to the dependency’s implementation, the security posture would be concerning; otherwise, this appears to be incomplete or non-module documentation. Request the actual package/module source files (not truncated notes) to validate sinks and data flows.

The provided fragment is best characterized as a highly malicious post-exploitation runbook: it explicitly targets credential/secret theft (LSASS/SAM/LSA equivalents, /etc/shadow, cloud and browser credentials, git/environment leaks), supports offline credential processing, and enables remote command execution via reverse shells/C2 with dynamic interpreter execution. Even though it is not confirmed as actual dependency code, in a supply-chain context this describes behavior that would be catastrophic if packaged or triggered. Action: treat as critical malicious content and do not use/redeploy unless fully disproven in actual module code and execution paths.

This fragment is highly suspicious supply-chain content because it provides weaponizable XXE exploitation logic: external DTD loading, local file reads (e.g., /etc/passwd via file:// and php://filter), and out-of-band data exfiltration to attacker infrastructure, plus SSRF/internal probing and docx XML injection techniques. While it is not runtime malware code, its inclusion significantly increases misuse potential and should be reviewed/removed or tightly isolated (e.g., defensive-only training materials with appropriate safeguards).

This artifact is high-risk and strongly indicates malicious/sabotage intent: it provides actionable instructions and examples to tamper with Unity IL2CPP Android apps by bypassing in-app purchase/receipt verification and altering monetization/economic logic via static native patching and dynamic Frida IL2CPP method hooking. No explicit network exfiltration or credential theft is demonstrated, but the described behavior is a practical integrity-bypass and unauthorized modification workflow. If distributed in a supply chain, it would meaningfully increase an attacker’s capability.

High-risk malicious/weaponized content: the fragment is a detailed container escape and Kubernetes cluster takeover playbook (recon->token abuse->privileged hostPath/hostNetwork pod creation->host/context execution and lateral movement), including references to known escape/kernel exploits and offensive tooling. No benign library logic is present.

This fragment is an end-to-end, functional ret2libc/ROP exploit template that leverages a leaked address from a remote service to compute libc base and then triggers system('/bin/sh') on the target, followed by io.interactive() to provide an interactive shell. In a supply-chain context, there is no evidence here of classic malware behaviors such as persistence or data exfiltration, but the included capability is inherently high-impact: if bundled into software that auto-runs or is executed outside the intended CTF context, it could enable remote shell access on affected systems. Treat the content as security-sensitive/offensive material rather than a benign dependency.

This fragment is an offensive SSL-pinning bypass guide with actionable Frida hook code that disables OkHttp certificate pinning and Conscrypt trust-chain verification (and suggests hostname verification bypass). It is designed to enable interception of HTTPS traffic (e.g., with Burp) and discusses evasion of anti-Frida measures—indicating high misuse potential. No obfuscation is present, but the security impact is substantial.

This artifact is highly actionable, weaponized Log4Shell exploitation material. It directly instructs how to craft JNDI payloads, verify them via OOB callbacks, stand up attacker-side LDAP/RMI/HTTP services, and achieve command execution/reverse-shell style outcomes. As a supply-chain component, it represents a serious abuse/propagation risk (even if it is not evidence of runtime malware execution).

High misuse risk. The fragment is an explicit, actionable Active Directory compromise playbook centered on Kerberoasting/AS-REP roasting, offline password cracking, BloodHound-assisted privilege pathing, and optional high-impact post-exploitation steps (e.g., NTDS extraction and credential dumping). There is no code obfuscation; the danger comes from operational guidance that enables credential theft and escalation to Domain Admins.

The fragment contains directly reusable offensive capabilities: it provides concrete Frida logic to bypass iOS jailbreak/anti-tamper checks by falsifying NSFileManager existence results and replacing fork() to force deterministic failure behavior. It also describes enabling HTTP(S) traffic inspection by defeating SSL pinning and using trusted MITM tooling. There is no evidence of obfuscation. If distributed as a software dependency, it would materially increase an attacker’s ability to tamper with app integrity checks and intercept network traffic, indicating a high security risk despite the testing framing.

The provided material is an attacker-style exploitation chain describing SSRF-based cloud metadata credential harvesting (including IMDSv2 token steps) followed by full object-storage bucket enumeration and bulk export/synchronization. This indicates highly malicious intent/impact in an offensive context, but the fragment is not actual dependency source code, so it cannot definitively prove that a particular package contains malware. Treat any inclusion of similar logic/scripts in a dependency as critical to investigate.

This fragment describes a high-suspicion loader pattern: an embedded compressed payload in a disguised ARM64 ELF container, reconstructed via a custom LZSS-like decompressor and executed in-memory by mmap→mprotect(RW→RX)→jump. It also notes analysis-evasion tactics (misleading file type and intentionally corrupted ELF headers) and payload characteristics consistent with process-injection intent. Even though the actual runnable code is not included here, the described behavior is characteristic of malware droppers/loaders, making the overall security risk moderate-to-high for a dependency context.

The code is a local evidence-to-report consolidation tool and contains no apparent malicious behavior. Its main security issue is insufficient validation of evidence IDs before using them in filesystem paths, enabling path traversal and unintended file reads or overwrites when invoked with attacker-controlled arguments. Direct insertion of arguments into Markdown can also corrupt reports, but no executable sink is present. The shown syntax error may prevent execution.

This fragment is an explicit offensive Active Directory compromise procedure (NTLM relay + coercion + delegation abuse + Kerberos impersonation + domain controller secrets dumping). It contains no benign library behavior and, if present in any software package or execution path, would be directly usable for unauthorized intrusion and credential theft. No meaningful obfuscation is present, and the intent is unambiguous.

The code appears to be a legitimate evidence and report management script, not malware. It performs local filesystem reads and writes only. The main security risk is path traversal or unintended file targeting through unvalidated EvidenceIds, combined with unrestricted caller control over CaseRoot. Evidence IDs should be restricted to safe filename characters and resolved paths should be verified to remain beneath the evidence directory. Markdown and regex replacement inputs should also be escaped or validated.

This artifact provides highly actionable malicious capability: an end-to-end AD CS ESC1 abuse chain that escalates privileges via certificate impersonation and then performs DCSync-style credential dumping. It contains explicit operational steps, target parameters, and example credentials, with no defensive intent or benign software behavior described.