AWS Penetration Testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs extracting and then embedding credentials verbatim into commands and environment variables (e.g., export AWS_ACCESS_KEY_ID=ASIA..., enumerate-iam.py --access-key AKIA... --secret-key ..., aws_consoler -a AKIAXXXX -s SECRETKEY), which requires the LLM to handle and output secret values directly, posing an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These are not obvious direct executable download links but they include sensitive AWS metadata/container endpoints, S3 bucket discovery patterns and a public bucket index plus GitHub offensive tooling (Pacu, enumerate-iam, aws_consoler) — legitimate red‑team resources that can be abused to steal credentials, enumerate/compromise cloud resources, or host malicious payloads, so they pose a significant security risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content is clearly malicious: it provides explicit, actionable steps for credential theft (SSRF to metadata, extracting temporary creds), privilege escalation (creating access keys, attaching admin policies, PassRole+RunInstances), backdooring (updating Lambda code with escalatory/backdoor payloads, building/pushing backdoored container images), data exfiltration (syncing/downloading S3, mounting EBS snapshots, extracting NTDS.dit), persistence and stealth (covering tracks by disabling CloudTrail, user-agent evasion), and other abuse techniques that enable unauthorized takeover and persistence of AWS accounts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md workflow explicitly instructs fetching and downloading arbitrary third-party content (e.g., "aws lambda get-function" followed by wget of the "url-from-previous-query", S3 sync/download commands, and SSRF calls like https://app.com/proxy?url=...), which requires the agent/operator to ingest untrusted user-provided web/S3/Lambda content and act on it (extract credentials, modify actions), exposing it to indirect prompt-injection via those external artifacts.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit privileged local actions (e.g., using sudo to create/mount /mnt/stolen), and instructs techniques that obtain or abuse elevated privileges and persist changes, which would modify or compromise the host/agent machine state.