What the reviewer found

AWS IAM PassRole privilege-escalation skill from a pentest skill library (Mingyi-Atlas). The EC2 user-data example that curls IMDS credentials and POSTs them to attacker.com is a real exfiltration technique demonstrated for an authorized red-team target, not a channel the installer is exposed to.

• dual-use — a security tool that can be misused
• credential-access — reads credentials
• exfiltration — sends data out
• network — calls the vendor’s API

What was read

The file as it ships in MingyiSecLab/Mingyi-Atlas:

• src/skills/standard/cloud/aws-iam-passrole-chain/SKILL.md

What the static scan said

The scan flagged 4things. The reviewer kept 3 and dismissed 1 as false.

• E1Sends data to an external URL — real
• PE3Reaches for credential files — false positive
• SSRF1Cloud metadata endpoint — real
• NETMakes network calls — real

How this review was made

Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.

Produced by agentmods.dev · Sonnet 5 · 7 September 2026