gcp-exploit

Fail

Audited by Socket on Sep 23, 2026

3 alerts found:

Malwarex2Security
MalwareHIGH
SKILL.md

MALICIOUS。该技能不是普通云运维或审计指南,而是系统化的GCP攻击手册,明确指导窃取凭据、提权、数据访问、持久化和向外部域名外传令牌/密钥。其能力与“攻击方法论”一致,但这一目的本身使其对AI代理而言属于高危恶意技能。

Confidence: 98%Severity: 99%
MalwareHIGH
references/gcp-iam-privesc.md

该输入是一份高风险的 GCP IAM 提权操作指南,不是普通软件依赖源代码。其内容同时包含合法审计建议和明显的攻击性示例,尤其是创建高权限凭据、公开部署恶意云资源以及向 attacker.com 外传令牌或密钥。若按软件包内容分发,这些示例会显著促进凭据盗窃和云环境接管;应将其限制在授权的隔离测试环境,并删除或改写真实外传和凭据获取步骤。

Confidence: 99%Severity: 98%
SecurityMEDIUM
references/gke-attack.md

The fragment is a clear offensive cloud/Kubernetes post-exploitation playbook. It enables RBAC escalation, Kubernetes and GCP credential extraction, secret disclosure, and lateral movement. It does not itself demonstrate executable malware or obfuscation, but its content is dangerous and inappropriate for an ordinary software-supply-chain library unless it is explicitly part of an authorized security-testing tool and is isolated from automatic execution.

Confidence: 98%Severity: 90%
Audit Metadata
Analyzed At
Sep 23, 2026, 04:25 AM
Package URL
pkg:socket/skills-sh/wgpsec%2Faboutsecurity%2Fgcp-exploit%2F@3a41d6f1aa7d6200691593d304fdca1a66116cdc25d2843f7c1ff214a4ef6607