cloud-aksk-exploit
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous pre-configured CLI commands for the
awsandtccli(Tencent Cloud) tools to perform administrative actions, such as resetting instance passwords, modifying security groups, and interacting with KMS/Secrets Manager. - [PRIVILEGE_ESCALATION]: Instructions detail how to create full 'AdministratorAccess' policies and attach them to the current or new users to bypass initial permission constraints.
- [PERSISTENCE]: The skill explicitly outlines a 'backdoor' phase, providing commands to create new persistent service users and long-lived Access Keys to maintain access after temporary credentials expire.
- [EXTERNAL_DOWNLOADS]: Recommends the installation of the external
enumerate-iamPython package and provides commands to download Lambda function code packages from remote AWS-managed URLs usingcurl. - [DATA_EXFILTRATION]: Provides instructions for identifying and downloading sensitive data from storage buckets (S3/COS) and retrieving secrets from managed secret stores.
Audit Metadata