cloud-imds-ssrf
Fail
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: HIGHDATA_EXFILTRATIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides instructions to access the cloud Instance Metadata Service (IMDS) at the link-local IP 169.254.169.254 and metadata.google.internal. These endpoints are used to retrieve highly sensitive information, including temporary IAM credentials such as AccessKeyId, SecretAccessKey, and Session Tokens.\n- [PRIVILEGE_ESCALATION]: The instructions facilitate escalating from a confirmed SSRF vulnerability to full identity theft of the cloud instance's attached service role, allowing the agent to perform actions with the permissions of the underlying infrastructure.\n- [INDIRECT_PROMPT_INJECTION]: \n
- Ingestion points: The skill guides the agent to process responses from external cloud metadata endpoints which are outside the agent's direct control.\n
- Boundary markers: There are no instructions or delimiters provided to ensure the agent ignores potentially malicious or malformed instructions returned by these services.\n
- Capability inventory: The skill leverages curl for network requests and awscli for credential management and cloud API interaction.\n
- Sanitization: No data validation or sanitization is performed on the content retrieved from metadata services before it is used to configure the agent's environment.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using curl and awscli to interact with sensitive internal network resources and configure environment credentials using harvested keys.
Recommendations
- AI detected serious security threats
Audit Metadata