aiml-gpu-training-cluster-investigation

Warn

Audited by Socket on Oct 12, 2026

3 alerts found:

Anomalyx2Security
AnomalyLOW
evals/functional/v5/iteration-3/gpu-log-coverage-audit/with_skill/outputs/journal_records.json

No malicious executable behavior is evident in the visible fragment. It appears to be investigation data, but it contains AWS STS session-token values and therefore presents a credential-disclosure risk. Treat the tokens as exposed and verify or revoke credentials as appropriate; the visible expiration timestamps are past. This assessment is limited to the shown portion.

Confidence: 98%Severity: 62%
SecurityMEDIUM
evals/functional/v5/iteration-2/capacity-block-expiry/with_skill/outputs/journal_records.json

This fragment does not show executable malicious behavior. It does expose an unredacted temporary AWS STS session token and sensitive infrastructure metadata in serialized investigation records. Treat the token as compromised, verify its validity and revoke or contain the associated session if possible, and remove or restrict access to the exposed transcript.

Confidence: 99%Severity: 73%
AnomalyLOW
evals/functional/v5/iteration-3/gpu-log-coverage-audit/without_skill/outputs/journal_records.json

No clear evidence of malware or intentional obfuscation appears in this excerpt. It does expose an AWS session token in logged and repeated request headers; treat it as compromised if it might still be valid, revoke or rotate credentials as appropriate, and avoid retaining or sharing unredacted logs. The token may be expired based on the displayed dates, but this cannot be confirmed from the fragment.

Confidence: 96%Severity: 56%
Audit Metadata
Analyzed At
Oct 12, 2026, 02:33 AM
Package URL
pkg:socket/skills-sh/aws%2Ftools-for-devops-agent%2Faiml-gpu-training-cluster-investigation%2F@03b9929fb1ec7ee251e86867e15ef942c497c845135f141a2cabfc41eb1176e3