cloud-security

SUSPICIOUS/HIGH-RISK skill. Its capabilities are internally consistent with its stated purpose, but that purpose is to enable offensive cloud attacks by an AI agent, including credential theft, privilege escalation, phishing, and persistence. No clear evidence of hidden malware or third-party credential interception is present in the provided text, but the exploit-oriented scope makes the skill dangerous.

The fragment is a readable offensive AWS IAM privilege-escalation and post-exploitation playbook. It contains no package malware or automatic execution mechanism, but it provides directly usable commands for policy takeover, privileged code execution, credential exposure, cross-account abuse, secret retrieval, and detection evasion. It should be treated as high-risk operational content and used only in explicitly authorized security testing.

The input is an offensive cloud-security exploitation guide, not an npm or other package source file. If its commands or referenced automation are executed, they can retrieve cloud credentials through SSRF or local metadata access and facilitate EKS identity pivoting. The supplied text contains no executable malware or embedded secrets, but it presents a high security risk as actionable credential-harvesting guidance. Assessment of imds_harvester.py or MKAT requires those files.

The fragment is an explicit dual-use Kubernetes exploitation and container-escape guide. It contains actionable commands and payloads for host compromise, credential and secret theft, RBAC escalation, persistence, and reverse shells, balanced with defensive detection guidance. It is not itself executable package malware and contains no obfuscation, but it would be high-risk content to distribute or execute in an unauthorized environment.

This is security research or attack-playbook content containing highly actionable procedures for OAuth token theft, managed-identity abuse, service-principal backdooring, and Global Administrator escalation. It is not executable package code and shows no intrinsic malware behavior, but unauthorized execution of the supplied commands presents a high security risk. Treat as dual-use offensive documentation and restrict execution to authorized testing environments.

The code is a dual-use Kubernetes RBAC reconnaissance and abuse-primitive mapping utility. It performs authenticated authorization checks and does not directly exploit the permissions it identifies. The main security concerns are automatic TLS verification bypass in --in-pod mode and the possibility of sending a service-account token to a user-specified server. These are meaningful operational risks, but the fragment contains no clear malware or covert exfiltration behavior.

The code is an explicit cloud metadata credential harvesting utility. It supports direct access to AWS, Azure, and GCP metadata services and SSRF-based access, including AWS address-filter bypass techniques. Although the code is readable and lacks persistence or hidden exfiltration, retrieving and printing cloud credentials is unauthorized behavior in typical package contexts and creates a severe credential exposure risk. It should not be included in a general-purpose dependency or executed against systems without explicit authorization.

This is an offensive GCP privilege-escalation and post-exploitation guide. It contains explicit commands and code for impersonating service accounts, harvesting metadata tokens, granting token-creator permissions, creating keys, injecting SSH keys, accessing secrets, and evading detection. It is not itself executable malware, but the documented actions are high-risk and would facilitate credential theft and unauthorized cloud access. Use only in an authorized assessment or controlled lab.

The code is intentionally designed for device-code phishing and OAuth token capture, with additional support for FOCI refresh-token redemption. It captures authentication tokens after a target is induced to authenticate and exposes them through console output. This is malicious account-compromise functionality even though requests are sent to the legitimate Microsoft endpoint and there is no hidden exfiltration or obfuscation.

The input is not source code for an npm dependency and does not itself demonstrate malware execution. It is a dual-use cloud-security guide containing actionable credential-extraction and CI/CD federation-abuse procedures, including OPSEC advice. The content should be treated as sensitive offensive security material; its described techniques represent significant security risk when applied without authorization.