hunt-cloud-misconfig

The skill’s cloud-misconfiguration purpose is plausible, and its local testing setup uses an official, version-pinned LocalStack image. However, it goes beyond detection into credential acquisition, RCE, real-resource enumeration, and explicit covert data exfiltration via AWS RUM. The exfiltration instructions are fundamentally incompatible with a proportionate misconfiguration-hunting skill; classify as malicious.