implementing-security-chaos-engineering

SUSPICIOUS. The install path is benign and AWS-aligned, but the skill’s actual capability is to disable security controls and simulate offensive scenarios with real-world impact. This is coherent with its stated purpose, yet still high risk for an AI agent because it enables disruptive security bypass actions and lacks strong operational guardrails.

The code is readable and purpose-consistent with an AWS security chaos-testing utility. It contains no apparent credential theft, exfiltration, persistence, reverse shell, cryptomining, or obfuscated payload. However, it deliberately performs highly destructive security changes—unrestricted SSH exposure, creation of an AdministratorAccess user, and CloudTrail disabling—and suppresses rollback failures. It should only be run in an isolated, explicitly authorized environment with strong account, identity, confirmation, and cleanup controls.

The fragment documents security chaos experiments and contains examples that intentionally modify AWS security controls, including opening SSH globally and stopping CloudTrail. These operations are high impact if run outside an isolated, authorized test environment, and the rollback and permission-safety mechanisms are incomplete. No evidence of malware, data exfiltration, persistence, obfuscation, or hidden backdoors is present in the supplied code.