argocd-tactics
Fail
Audited by Socket on May 9, 2026
2 alerts found:
SecurityMalwareSecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
该技能不是常规ArgoCD管理或安全审计指南,而是面向AI代理的ArgoCD攻击与后渗透手册,涵盖未授权访问、认证绕过、SSRF、默认凭据利用及Kubernetes集群接管。未见可疑安装链或凭据转发到第三方,但其核心用途本身就是为代理提供进攻性安全能力,整体应判定为高风险、可疑且不适合作为普通开发/运维技能。
Confidence: 96%Severity: 94%
Malwarereferences/detection-and-post-exploit.md
HIGHMalwareHIGH
references/detection-and-post-exploit.md
This fragment is a clear malicious exploitation procedure for Argo CD. It demonstrates authenticated abuse to create an attacker-controlled Application that can deploy arbitrary manifests with automated prune/self-heal persistence, and it outlines minting/reusing Argo CD tokens to continue unauthorized API/CLI control. If this content were included in a repository/package as executable logic, it would represent a critical supply-chain security risk.
Confidence: 90%Severity: 100%
Audit Metadata