cloud-security

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt instructs retrieving secrets (IMDS tokens, service-account tokens, Secrets Manager values) and shows using them directly in commands/Authorization headers (e.g., --token/$TOKEN or curl -H "Authorization: Bearer ..."), which requires including secret values verbatim and creates an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content is explicitly offensive: it instructs credential theft (IMDS/metadata token retrieval, Secrets Manager/SSM decryption, service account key creation), privilege escalation and account takeover (CreatePolicyVersion, AttachUserPolicy, Create/UpdateLoginProfile, sts:AssumeRole, PassRole → create privileged Lambda/EC2), remote code injection/backdoor installation (lambda:UpdateFunctionCode, creating functions with admin roles, adding SSH keys via metadata, writable hostPath → /etc/cron.d), detection evasion (aws cloudtrail stop-logging), container/host compromise (docker.sock mount, chroot, runc/containerd CVE exploitation, nsenter for privileged pods), and automated exploitation/supply of tooling (Pacu, peirates, peirates/peirates-like tools) — all of which are deliberate malicious patterns enabling data exfiltration, persistent backdoors, and remote code execution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs fetching and downloading content from untrusted public storage and services (e.g., aws s3 ls / aws s3api, aws lambda get-function which provides a download link, and gsutil cp from GCS buckets), meaning the agent will ingest user-generated third‑party data that could contain instructions influencing subsequent actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit, actionable instructions to escape containers and access or modify the host filesystem (nsenter, mounting /:/host and chroot, writing to /etc/cron.d), plus steps to add SSH keys/create credentials and stop logging — all of which instruct the agent to modify or compromise the machine or its environment.