Not in the top 1,000 by GitHub stars
bluechips-zhao/av-evasion-skills
AV Evasion Skill v5.2 是一套完整的 Shellcode 免杀方案，采用 Indirect Syscall、ETW 补丁、Module Stomping、.text Code Cave、字符串编译期加密、IPv4 混淆、XOR 加密、HeapAlloc 缓冲以及直接函数指针调用等技术，从静态特征、行为轨迹、EDR 感知三个层面绕过主流杀软和 EDR。
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
SKILL.md
Week of Nov 2, 2026 · Line counts unavailable
Before Not checked yet → After Local scripts
First observation → d88c982108be
No earlier version was observed for comparison.
Heat
5.1- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
How it works
ai-av-evasion-optimized
When your agent uses it
使用AI生成免杀Loader和处理Shellcode，结合Indirect Syscall、ETW补丁、Module Stomping、字符串加密、IPv4混淆等免杀技术绕过主流杀软和EDR检测
What it loads into context
Frontmatter
89 tokensAlways available to the agent
SKILL.md
3,785 tokensWhen the skill is activated
Reference documents
3,747 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 功能描述
- 使用场景
- 核心技术
- 编译
- 使用指南
- 文件清单
- 注意事项
Scripts executed separately
scripts/gen_embed_data.pyscripts/shellcode-encrypt.pyscripts/shellcode-obfuscate-ipv4.pyscripts/shellcode-patch.py
Files
README.mddoc13,153 bytesSKILL.mdcore12,731 bytesSKILL.mdcore12,731 bytesSKILL.mdcore12,731 bytesSKILL.mdcore12,731 bytesSKILL.mdcore12,731 bytesSKILL.mdcore12,731 bytesSKILL.mdcore12,731 bytesscripts/gen_embed_data.pyruns3,035 bytesscripts/loader_v5.casset17,834 bytesscripts/payload_data.hasset58,602 bytesscripts/shellcode-encrypt.pyruns2,097 bytesscripts/shellcode-obfuscate-ipv4.pyruns2,513 bytesscripts/shellcode-patch.pyruns3,935 bytesscripts/tcp_windows_amd64.binasset1,388 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubSkills included
- ai-av-evasion-optimized
Repository facts
- License
- No license detected
- Created
- Jun 24, 2026
- Last pushed
- Sep 27, 2026
- Forks
- 37
- Open issues
- 1
- Project activity
- Active
Before you install
Local scriptsAutomated signals, not a guarantee
Offensive security tool: run only in authorized labs.
Checked Nov 6, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 6 notes
SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedSKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedSKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedSKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedSKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedSKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- No dangerous shell commands
- 3 network referencesin 1 file: README.md:370
- No hidden or obfuscated text
- No instruction overrides
- 4 executable scriptsin 4 files: scripts/gen_embed_data.py:1 scripts/shellcode-encrypt.py:1 scripts/shellcode-obfuscate-ipv4.py:1 and 1 more
- No access to secrets
- No requests to vote in Hot
Show all 7 signals by file
README.md
- Network accessline 370
<https://img.remit.ee/api/file/BQACAgUAAyEGAASHRsPbAAEWSRFqQdZ84zinoByzmBI3yShdjaWbAQACnyIAAv6GEFbeygfRJhnU9zwE.png> - Network accessline 379
<img width="2560" height="1248" alt="image" src="https://github.com/user-attachments/assets/97b621af-775b-47e7-b82c-5b9e2eb6beaf" /> - Network accessline 381
<img width="2560" height="1248" alt="image" src="https://github.com/user-attachments/assets/40c18ab7-4d58-484e-8861-8d8cbc46e74c" />
scripts/gen_embed_data.py
- Executable scriptline 1
#!/usr/bin/env python3
scripts/shellcode-encrypt.py
- Executable scriptline 1
#!/usr/bin/env python3
scripts/shellcode-obfuscate-ipv4.py
- Executable scriptline 1
#!/usr/bin/env python3
scripts/shellcode-patch.py
- Executable scriptline 1
#!/usr/bin/env python3
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Signal confidence: 7 facts
- Network access in prose of documentationREADME.md:370Low confidence
- Network access in prose of documentationREADME.md:379Low confidence
- Network access in prose of documentationREADME.md:381Low confidence
- Executable script in code of a file that runsscripts/gen_embed_data.py:1High confidence
- Executable script in code of a file that runsscripts/shellcode-encrypt.py:1High confidence
- Executable script in code of a file that runsscripts/shellcode-obfuscate-ipv4.py:1High confidence
- Executable script in code of a file that runsscripts/shellcode-patch.py:1High confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Compatible | Standard SKILL.md SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
