aws-penetration-testing
Audited by Snyk on Jun 26, 2026
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs extracting, exporting, and embedding AWS access keys, secret keys, and session tokens into CLI commands and scripts (e.g., aws configure, export AWS_ACCESS_KEY_ID=..., enumerate-iam.py --access-key ..., aws_consoler -a ... -s ...), which requires the model to handle and output secret values verbatim, creating a high exfiltration risk.
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.95). These URLs are highly suspicious because they include SSRF/metadata endpoints and container credential URLs, public S3 bucket patterns and bucket search sites (which can host arbitrary payloads), plus links to offensive-security GitHub tools — together they enable credential theft, remote code execution and distribution of malicious artifacts.
CRITICAL E006: Malicious code pattern detected in skill scripts.
- Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable instructions for credential theft (SSRF to IMDS, creating access keys), privilege escalation (attaching admin policies, PassRole, injecting/updating Lambda code), data exfiltration (S3 sync, EBS snapshot mounting, downloading Lambda code), backdooring (updating functions/images with malicious code), and cover-up techniques (disabling CloudTrail, user-agent evasion), indicating deliberate malicious capability.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.85). The workflow includes SSRF/metadata access to AWS IMDS endpoints (e.g.,
http://169.254.169.254/latest/meta-data/iam/security-credentials/), which returns credential JSON that the agent would ingest as readable text into the LLM context.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime installation/execution of remote code (e.g., "git clone https://github.com/NetSPI/aws_consoler" with a subsequent aws_consoler invocation, and similar git clone/pip install instructions like https://github.com/RhinoSecurityLabs/pacu and https://github.com/andresriancho/enumerate-iam) which fetches and runs external repositories/tools during execution.
MEDIUM W013: Attempt to modify system services in skill instructions.
- Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt gives explicit, actionable instructions to perform privileged, state-changing operations (create access keys/users, attach admin policies, update Lambda code, disable CloudTrail, mount volumes with sudo, etc.) that enable privilege escalation, persistence and modification of the target environment and the agent's host, so it clearly pushes compromise of machine/account state.
Issues (6)
Insecure credential handling detected in skill instructions.
Suspicious download URL detected in skill instructions.
Malicious code pattern detected in skill scripts.
Third-party content exposure detected (indirect prompt injection risk).
Unverifiable external dependency detected (runtime URL that controls agent).
Attempt to modify system services in skill instructions.