[Q&A] Windows Security Detects Trojan in pentest-tools/src-hunter Reference Files

[RazneshPrajapati]

What kind of help do you need?

Installation or setup

Your question

Hello maintainers,

I recently downloaded the agentic-awesome-skills repository, and Windows Security detected a Trojan in the following two Markdown files:

1. skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md
2. skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md

Since both detections are associated with Markdown reference files related to penetration testing, I am unsure whether this is a false positive caused by security-testing payloads and examples or whether the files contain genuinely malicious content.

Could the maintainers or anyone familiar with these files please clarify the following?

• Are these files expected to trigger antivirus detections because they contain WAF bypass techniques, XSS payloads, or other security-testing examples?
• Have these specific files been reviewed or scanned for malicious content?
• Is there any known issue with Windows Security detecting these files?
• Is it safe to use the src-hunter skill after reviewing these detections, or should these files be avoided until further investigation?

Environment and context

No response

What have you already tried?

• Antivirus: Microsoft Windows Security (Microsoft Defender)
• Detection name: Trojan:HTML/Redirector.BQ!atmn
• Affected files:
  • skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md
  • skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md

Before posting

• I checked the README, FAQ, and relevant docs first.

[ahmedhany-cys]

This is a signature false positive on reference text, not a compromised repo, and it's partly fixed already.

The two files are Markdown documentation. They don't execute anything on clone or install; they only hold pentest payload examples as text. Defender's Trojan:HTML/Redirector.BQ matches HTML redirect-style patterns inside those examples, and the !ml / !atmn suffixes on the names mean the verdict came from the automatic/ML classifier rather than a hand-written signature, which is exactly the class of detection that over-fires on security-reference content.

It's also a known issue here. It was tracked in #2174 and addressed in #2178 (merged Oct 29). That PR moved the raw payloads for xss跨站脚本.md (and playbooks/xss.md) into Base64 companion files (*.payloads.b64) so the cloneable Markdown no longer carries the active-looking markup that tripped Defender. So for that second file you listed, pulling latest main should clear the flag; if you're still on an older checkout, that's why you're seeing it.

The first file, payloader/waf-bypass.md, wasn't part of that PR. Its current content is methodology prose plus a catalogued payload index with explicit "authorized testing only" boundaries, and I don't see live <script>, javascript:, or onerror markup in it, so a heuristic hit there is the same false-positive class.

Safe way to handle it:

• Pull latest main first and re-scan; that resolves the XSS file.
• Treat these as data. They do nothing unless you open them and deliberately run the payloads in an isolated lab.
• If you want independent confirmation, drop the flagged file in VirusTotal and look at how few/which engines flag it and under ML names.
• Don't blanket-exclude the whole repo path in Defender. If you need the waf file locally and it keeps getting quarantined, restore just that one file or exclude that single path, rather than whitelisting everything.

[sickn33]

Thanks for reporting the exact paths. We investigated this family of detections, and there is an important distinction between the two files.

• xss跨站脚本.md: fix: encode XSS references for Windows clone safety #2178 moved the original XSS examples into an explicit Base64 companion file. This change is present in GitHub tag v20.2.0. The decoded bytes match the previous reference document exactly; encoding changes how the examples are stored, not what they can do if executed.
• payloader/waf-bypass.md: this file was not covered by fix: encode XSS references for Windows clone safety #2178 and still contains raw <script>, javascript: and onerror examples. The earlier comment's statement that these strings are absent is incorrect. Other reference documents also retain attack examples, so the change does not establish that an entire clone will be free of antivirus alerts.

Our static inspection found documented security-testing payloads, not an automatic infection mechanism in these files. We also checked the actual v20.2.0 runtime archive: its digest matches the published manifest, all 109 files in this bundle match the inspected source, and its package has no npm installation lifecycle hooks. The installer copies these reference files; we found no automatic decoding or execution of the samples. Four focused installer/reference tests passed. These checks are not an antivirus verdict or a guarantee about every skill or dependency.

We have not reproduced the detection or tested the updated files with a current Windows Defender engine. We therefore cannot call this a Microsoft-confirmed false positive, identify the exact detector trigger from the threat name alone, or promise that updating clears the alert.

Please keep Defender enabled and leave quarantined material quarantined while investigating. Share the exact repository commit or package version, full affected path, SHA-256, and Defender engine/security-intelligence versions so we can compare the same bytes. Suspected misclassifications can be submitted to Microsoft Security Intelligence for analysis.

Treat the decoded examples as untrusted offensive test material, use them only in an isolated authorized lab, and review any skill before allowing an agent to act on it. Further findings from our investigation are in #2191.