attacking-serverless
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides instructions for exfiltrating environment variables to a remote domain (attacker.com) using curl.
- [CREDENTIALS_UNSAFE]: The content details how to target and extract sensitive cloud identity tokens and access keys from AWS, Azure, and GCP execution environments.
- [COMMAND_EXECUTION]: Includes techniques for establishing persistence by writing scripts to the /tmp directory that execute arbitrary shell commands via os.system.
- [REMOTE_CODE_EXECUTION]: Details a remote code execution pattern where environment variables are base64-encoded and sent to an external server.
- [PROMPT_INJECTION]: The skill describes an Indirect Prompt Injection surface where untrusted data from event sources like S3, SQS, and SNS is processed. 1. Ingestion points: S3 bucket names and object keys, SQS/SNS message bodies, API Gateway query strings, headers, and body. 2. Boundary markers: Absent. 3. Capability inventory: Shell command execution (aws, az, gcloud), network access via curl, and file system writes to /tmp. 4. Sanitization: Missing validation mentioned for several event sources such as SQS and SNS message bodies.
Audit Metadata