Cloud Penetration Testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes numerous examples that print, export, or embed secrets verbatim (e.g., converting service-principal secrets to plaintext, az/ad/cli commands with // placeholders, Import/Export of stolen tokens, and scripts that echo password fields), which requires the agent to handle and output secret values directly and thus poses high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content provides explicit, actionable instructions for credential theft, data exfiltration, privilege escalation, and the creation of persistent backdoors/service principals across Azure, AWS, and GCP, making it highly likely to be abused for malicious purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md workflow clearly instructs fetching and ingesting untrusted public content (e.g., aws s3 sync s3://bucket-name, aws lambda get-function ... | jq '.Configuration.Environment', python3 cloud_enum.py -k targetcompany, and curl requests to public endpoints/GitHub) as integral steps, which the agent would read/interpret and could materially influence subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's prerequisites include runtime commands that fetch and execute remote installers — e.g., curl https://sdk.cloud.google.com | bash and curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" followed by sudo ./aws/install — which download and run remote code and are required for the skill.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly includes commands that run installers and file operations with sudo (e.g., "sudo ./aws/install", "sudo find /home ...", "sudo cp -r /home/user/.config/gcloud ...") and curl|bash installers that modify the host environment, so it directs the agent to perform privileged changes to the machine it runs on.