cloud-penetration-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains commands that pass secrets directly on the command line (e.g., --secret_access_key, --password) and scripts that print user property values matching "password" or retrieve Key Vault secrets, which would require the agent to handle or embed secret values verbatim if real secrets are supplied.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content contains explicit, actionable offensive cloud-attack instructions (secret exfiltration, credential theft, remote command execution, and creation of persistent backdoors/service principals/access keys) and is high risk for malicious abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow in SKILL.md ingests untrusted free text via user/attacker-supplied target identifiers (e.g., “exact target URL, IP, account, or resource” in the mandatory confirmation gate) which then drive runtime commands such as curl to Microsoft/Azure/AWS/GCP endpoints and authentication/enumeration flows.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisites include runtime commands that download and execute remote installers (https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip and https://sdk.cloud.google.com), so those URLs fetch remote code that is executed and are required dependencies.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs running sudo-enabled installers and using sudo to read and copy other users' home directories on the host (e.g., sudo ./aws/install and sudo find/cp), which directs modification and privileged access of the machine the agent runs on.