Reduce Golang Detections Skill — Testing skill for Claude Code

reduce-golang-detections-skill

A [Claude Code](https://claude.com/claude-code) skill for systematically reducing VirusTotal and EDR detection rates on compiled Go binaries through structural analysis, iterative A/B testing, and ML feature vector optimization.

A companion blog post will be linked here once published.

What this is

Modern EDR detections on Go binaries are dominated by statistical ML classifiers (e.g. Microsoft `Wacatac.B!ml`, `ML.Attribute.HighConfidence`, `MalwareX-gen`, `Evo-gen`) rather than fixed-byte YARA rules. Defeating an ML classifier is a fundamentally different problem from defeating a signature — renaming strings and swapping imports often makes detection *worse*, because the resulting binary diverges further from the vanilla toolchain baseline the classifier has learned as "normal."

This skill packages a disciplined methodology for that problem:

• Triage detection type before remediation. Label every hit as YARA-style or ML-style. The fixes are different and not interchangeable.
• Change one variable per experiment. 10–20 samples per arm, control and variant built in the same VT upload window — Wacatac retrains on roughly a daily cadence, so a control batch from yesterday is not a valid A/B test.
• Measure with a comprehensive PE structural analyzer (included) before and after each change, and compare deltas against a vanilla binary from the same toolchain.
• Camouflage, not concealment. Give the classifier a believable answer to "what is this binary?" — mimicking the gopclntab symbol fingerprint of a single coherent large Go project consistently outperforms stripping, padding, or obfuscation.
• Recognize the irreducible floor. Once detection drops to ~15–25% on VirusTotal (the stochastic floor near the ML threshold), further structural optimization rarely pays back, and VT is not ground truth for real endpoints.

What's in the box

File	Purpose
SKILL.md	The skill itself — metho