← All skills

edr-bypass-re

100 / 100 · Low risk

Fine to try.

By stanfish06/skillquarium (GitHub) · other · 12 stars · scanned at commit ced6c96

逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。 触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike 绕过、Defender 绕过、Sentinel One 绕过、Elastic Defend、 Sysmon 规避、PPID spoof、Sleep mask、Process Hollowing、Reflective …

Works with any agent that supports SKILL.md skills.

What this skill can do

We found nothing in the files we read that matches our rules. That does not prove the skill is safe: see the limits of static scanning.

Other copies in this repository

stanfish06/skillquarium has 1 more folder with a skill named edr-bypass-re. This page shows the lowest-scoring copy.

• skills/reverse-skill-router/edr-bypass-re 100/100 · Low risk

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'edr-bypass-re' ] || [ -L ~/.agents/skills/'edr-bypass-re' ]; then echo 'A skill folder named edr-bypass-re already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/stanfish06/skillquarium' "$d" && git -C "$d" checkout --quiet 'ced6c96bd67acccbf0280a5071e59a523c118c66' -- 'skills/edr-bypass-re' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/edr-bypass-re' ~/.agents/skills/'edr-bypass-re' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'edr-bypass-re' ~/.claude/skills/'edr-bypass-re' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for stanfish06/skillquarium shows the score of its lowest-scoring skill.

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/stanfish06/skillquarium.svg)](https://zalavijaysinh.github.io/skilltrust/repos/stanfish06/skillquarium/)

Score history