cloud-penetration-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs extraction and disclosure of credentials (e.g., dumping Key Vault secrets, converting service-principal SecureString to plaintext, creating access keys and passing --secret_access_key), which requires handling and outputting secret values verbatim and therefore poses a high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content provides explicit, actionable instructions for credential theft, data exfiltration, privilege escalation, persistence (backdoor service principals and admin account creation), and remote code execution across Azure, AWS, and GCP—techniques that directly enable deliberate malicious compromise of cloud environments.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md workflow and examples explicitly instruct fetching and enumerating public third‑party content — e.g., curl to login.microsoftonline.com and metadata endpoints, aws s3 ls / aws s3 sync, gsutil ls, gcloud source repos clone, and referenced GitHub repos in references/advanced-cloud-scripts.md — which are untrusted/user-generated sources the agent is expected to read and use to drive follow-up actions and exploitation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisites include commands that fetch-and-execute remote installers that the skill depends on at runtime (e.g., "curl https://sdk.cloud.google.com | bash" to install the GCP SDK and "curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" followed by ./aws/install to install the AWS CLI), which clearly download and execute remote code required for the skill.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running privileged installation and file-access commands (e.g., sudo ./aws/install, sudo cp -r /home/..., curl ... | bash) and other actions that modify the host and require elevated privileges, so it pushes the agent to change the machine's state.