cloud-misconfig

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs embedding discovered credentials directly into commands (e.g., exporting AWS keys and passing access/secret/session tokens as CLI args or headers), which would force an LLM to include secret values verbatim in generated output if it followed those steps.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The S3 URL (https://target-uploads.s3.amazonaws.com) is a target-specific Amazon S3 bucket used for arbitrary file hosting and is a common vector for distributing untrusted executables and malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an offensive cloud-exploitation playbook describing step-by-step techniques to locate and abuse leaked credentials and misconfigured cloud services for data exfiltration and account takeover.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly runs "git clone https://github.com/initstring/cloud_enum" followed by "python3 cloud_enum.py -k target", which fetches remote code at runtime and then executes it (https://github.com/initstring/cloud_enum).