offensive-osint

High-risk offensive AI agent skill. Its capabilities are internally consistent with its stated red-team purpose, but that purpose itself grants an AI agent substantial reconnaissance and secret-validation power, plus transitive chaining into further offensive skills. No strong evidence of malware or covert credential theft appears in the provided file, but the overall security risk is high.

The provided content is not a software dependency module; it is an attacker-style reconnaissance and identifier-extraction workflow. It enables collection of sensitive security-relevant identifiers (AWS account IDs, OAuth client IDs/scopes), Microsoft 365 tenant/provisioning and potential exposure indicators, and GraphQL schema/field discovery via error/suggestion probing. While it contains no evidence of executable supply-chain malware itself, the operational guidance is strongly malicious in intent and materially increases the capability for targeted intrusion and data exposure.

No embedded malicious code is evidenced in this fragment (it is instructional documentation rather than a functioning dependency module with runtime compromise behavior). However, it directly enables offensive reconnaissance and targeted email list creation by combining breach/infostealer corpus queries, DNS posture inference for SSO exposure escalation, and email harvesting/pattern inference from multiple public sources and scraped content. If distributed as part of a package, treat it as high dual-use/misuse risk rather than supply-chain malware, and review intended use controls and scope.

This fragment is a credential-driven, multi-platform reconnaissance and token-triage playbook. It uses embedded/authenticated tokens to enumerate AWS IAM capabilities and logging/MFA posture, discover secret-relevant identifiers (AWS Secrets Manager/SSM, GitHub secrets metadata, Postman environment values), enumerate Slack private channels/users, and inventory accessible GitHub org/repo scope. It additionally includes explicit JWT attack testing steps (alg=none, RS→HS algorithm confusion, and HS256 brute-force guidance). No on-host malware/persistence is visible, but the operational intent and methods indicate malicious credential abuse and compromise preparation, resulting in an extremely high security risk if found in a dependency or distributed script.

This code fragment is not overtly malicious by itself, but it creates a high-impact security risk: it exposes unauthenticated HTTP endpoints that can trigger scanning of arbitrary existing filesystem paths supplied by a client and return the scan findings over the network. Additionally, it imports a local secret_scan module and runs a bundled helper script via subprocess with request-derived arguments, both of which are major opaque trust boundaries. If the service is reachable beyond a trusted local environment, it can enable unintended sensitive local data disclosure through the scan results.