azure-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). This prompt gives explicit commands and workflows that retrieve and use secrets (e.g., reading token caches, az keyvault secret show, az login --service-principal -u CLIENT_ID -p SECRET and other examples that embed secrets on the CLI), which would require an agent to handle or insert secret values verbatim—creating a high exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs are highly suspicious: they mix legitimate Azure/Microsoft endpoints (IMDS, login.microsoftonline.com, management.azure.com, Graph API, dev.azure.com, SAS URLs) that are commonly abused for token harvesting, privilege escalation and persistence with attacker-controlled domains and GitHub repos/personal-hosted endpoints (e.g., attacker.com, attacker runbooks/repo, unknown GitHub repos) that could host malicious payloads or receive exfiltrated credentials.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an explicit offensive playbook for compromising Azure environments—providing step‑by‑step instructions for credential theft (tokens, Key Vault secrets, cached CLI files), data exfiltration to attacker endpoints, remote code execution and backdoors (CustomScript, RunCommand, Runbook/code injection, Cloud Shell/profile persistence, reverse shells), and supply‑chain/persistence abuses (source‑control backdoors, federated credentials), and therefore constitutes high‑risk malicious guidance.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). 该技能在运行时会通过“未授权枚举/OSINT”路径对外部目标域名发起 curl/Invoke-*（如 Invoke-AADIntReconAsOutsider、curl https://login.microsoftonline.com/.../openid-configuration、Invoke-EnumerateAzureBlobs/SubDomains），从而把公网上抓取/返回的自由文本（HTML/XML/JSON/枚举结果）读入并进入代理的 LLM 上下文，属于公共 web 内容注入风险。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly shows configuring an Automation Account to auto-sync from "https://github.com/attacker/runbooks.git", which at runtime causes Azure to fetch external repository code and publish/execute Runbooks (remote code execution), so this is a runtime external dependency that executes remote code.