hunt-cloud-misconfig

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document explicitly instructs how to harvest AWS credentials (Cognito/IMDS), exfiltrate data covertly via CloudWatch RUM, and perform persistent DOM/supply-chain compromise — behavior intended to facilitate unauthorized access and data theft.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's verification steps run a remote Docker image ("docker run ... localstack/localstack:3.0"), which pulls and executes external code (localstack/localstack:3.0) at runtime.