tencent-pentesting
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONOBFUSCATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill provides comprehensive procedures for escalating privileges in Tencent Cloud Access Management (CAM) by modifying policies, creating access keys, and using Service Roles. It also details techniques for escalating privileges in Kubernetes clusters (TKE) via privileged pods.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install several tools including official CLI clients (tccli, coscmd) and third-party security frameworks like the Cloud Exploitation Framework (cf) from GitHub.
- [COMMAND_EXECUTION]: The skill describes how to use the Tencent Cloud Automation Tools (TAT) to execute shell commands on remote instances through the Cloud API.
- [OBFUSCATION]: The skill demonstrates the use of Base64 encoding for payloads in command execution examples, which is a standard technical requirement for the TAT service.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from cloud logs and metadata services, creating a surface for potential indirect prompt injection if those sources contain adversarial content.
Audit Metadata