cloud-containers

SUSPICIOUS. The skill is internally aligned with its stated purpose, but that purpose is to give an AI agent offensive cloud/container exploitation capability against live environments. No clear malicious exfiltration or deceptive install path is present in the provided files, yet the operational risk is high because the agent could perform real attack actions using supplied or ambient cloud credentials and contexts.

The fragment is an offensive cloud exploitation playbook. It contains no automatically executing malware in the visible text, but it deliberately enables credential harvesting, cloud data exfiltration, privilege escalation, SSRF, local file theft, Lambda abuse, and defense evasion. Its lab/CTF framing reduces certainty about malicious deployment intent but does not materially reduce the danger of the instructions if used against real systems.

The text is an offensive mock-AWS reconnaissance and exploitation guide. It does not itself demonstrate malware embedded in a package, but it documents credential enumeration, authentication bypass, secret discovery, command execution, and exfiltration techniques. Treat it as high-risk exploit content and use only in explicitly authorized lab environments.

This fragment is an offensive Azure/Azure DevOps exploitation guide. It documents actionable pipeline RCE, IIS payload deployment, SYSTEM-level privilege escalation, and cloud-resource enumeration or secret retrieval. It is not itself malware because no automatic execution or malicious package behavior is present in the visible text, but using the described techniques against unauthorized systems would be dangerous. The fragment is readable and not intentionally obfuscated.

The supplied text is an explicit GCP offensive-operation playbook. It documents credential theft, cloud-resource enumeration, GCS data access and public exposure, metadata-service token extraction, IAM privilege escalation, secret retrieval, and lateral movement. It is not obfuscated and is not package malware in the narrow sense, but executing these commands without explicit authorization presents an extremely high security risk.

This fragment is a high-confidence, end-to-end Kubernetes exploitation and post-exploitation playbook. It explicitly targets kubelet API abuse for command execution, performs service-account token theft and RBAC probing, escalates by creating privileged hostPath pods for node filesystem access, and guides data exfiltration via command output/log retrieval. If present in a distributed dependency, it represents extreme malicious capability rather than benign functionality.

This is not benign software logic; it is an offensive container reconnaissance and escape/privilege-escalation playbook containing actionable exploitation steps (Docker socket/privileged pivot, cgroup release_agent execution, and SUID/sysctl core_pattern injection) and even sensitive file access intended for host compromise. If present in a dependency and executed, it would be highly likely to enable unauthorized takeover of the host or surrounding infrastructure.

This fragment is unequivocally an offensive exploitation and exfiltration playbook targeting self-hosted MinIO/S3. It describes discovery of MinIO instances, authentication using default/guessed credentials, administrative IAM export, bucket/object enumeration, recursive bulk downloading of sensitive data (including SSH keys/config backups) to local disk, and pivoting using recovered credentials. It is highly indicative of malicious intent and should not be included or distributed as part of any software supply chain.