hunt-cloud-misconfig

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs retrieval of instance metadata / STS credentials and shows embedding stolen secrets (e.g., "") into aws rum put-rum-events payloads and exporting AWS keys, which requires the agent to handle/output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These S3 bucket endpoints are generic/public S3 URLs (including template/target placeholders) which can host arbitrary files or executables and are commonly abused to distribute malware or malicious artifacts.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, actionable instructions for stealing credentials (Cognito/IMDS), performing covert data exfiltration via CloudWatch RUM, and abusing writable public storage/endpoints—patterns that enable deliberate malicious activity.