cloud-iam-audit

该技能与其描述一致，但描述本身就是面向攻击性的云 IAM 提权与持久化利用，而非纯只读审计。安装来源基本官方，未见第三方凭据中转或隐藏执行；主要风险来自其为 AI 代理提供系统化的云权限枚举、提权、后门创建和日志规避能力，因此应归为高风险安全/攻击技能而非恶意载荷。

该代码片段不是普通业务模块，而是一份明确指导腾讯云权限提升、凭据窃取、持久化后门、跨账号接管和敏感数据获取的攻击手册。虽然示例需要用户主动执行且未展示独立的远程外传服务器，但其操作目标和隐蔽性建议具有明确恶意用途，不应在生产环境执行。

This fragment is not malware in the conventional sense (no executable behavior, exfiltration, or obfuscated payloads). However, it is high-risk instructional content: it explicitly guides generation of AWS IAM privilege-escalation and permission-enumeration tactics (including a PassRole+Lambda Create/Invoke workflow and response-based brute-force probing), plus credential-type usage guidance (AKIA vs ASIA/STS and SessionToken requirements). If distributed as part of a software package, it should be treated as an offensive playbook configuration and restricted/reviewed accordingly.

This fragment is an attacker-oriented AWS IAM privilege-escalation and secret-discovery/collection cheat-sheet. It provides explicit, step-by-step instructions to modify IAM policies to gain Administrator-level access, assume privileged roles (including cross-account trust considerations), abuse PassRole to deploy/execute Lambda with elevated permissions, and retrieve sensitive data from Secrets Manager/SSM (with decryption) and via recursive S3 discovery. No obfuscation is present, and the content is clearly intended for offensive cloud compromise and stealth.