AWS Penetration Testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs extracting, copying, and embedding AWS access keys, secret keys, and session tokens verbatim into commands and scripts (e.g., export AWS_ACCESS_KEY_ID=..., --access-key/--secret-key, aws_consoler -a ... -s ...), requiring the model to handle and output secrets directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The list includes instructions to clone and run offensive tools from public GitHub repos, download from arbitrary S3 buckets and public bucket indexes, and abuse internal metadata/container endpoints via SSRF to steal credentials—actions that, while using legitimate domains, enable credential theft, privilege escalation, and distribution/execution of untrusted code, so the overall sources are high-risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content is clearly malicious: it provides explicit, actionable steps for credential theft (SSRF to metadata, extracting temporary creds), privilege escalation (creating access keys, attaching admin policies, PassRole+RunInstances), backdooring (updating Lambda code with escalatory/backdoor payloads, building/pushing backdoored container images), data exfiltration (syncing/downloading S3, mounting EBS snapshots, extracting NTDS.dit), persistence and stealth (covering tracks by disabling CloudTrail, user-agent evasion), and other abuse techniques that enable unauthorized takeover and persistence of AWS accounts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md workflow explicitly instructs fetching and downloading arbitrary third-party content (e.g., "aws lambda get-function" followed by wget of the "url-from-previous-query", S3 sync/download commands, and SSRF calls like https://app.com/proxy?url=...), which requires the agent/operator to ingest untrusted user-provided web/S3/Lambda content and act on it (extract credentials, modify actions), exposing it to indirect prompt-injection via those external artifacts.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit privileged local actions (e.g., using sudo to create/mount /mnt/stolen), and instructs techniques that obtain or abuse elevated privileges and persist changes, which would modify or compromise the host/agent machine state.