redc

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:11 PM UTC
• Version: 1.0.3

Overview

This skill transparently helps deploy and manage cloud red-team infrastructure, with real but disclosed Terraform and cloud-account risks.

Install only if you intend to let an agent manage cloud infrastructure. Use a throwaway or tightly scoped cloud account, temporary credentials, verified redc and terraform binaries, a local-only MCP server, pinned and trusted templates, and always inspect template files plus the Terraform plan before start_case or compose_up.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:61

Finding

Externally Retrieved Terraform Templates Can Execute Arbitrary Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61-74
Vulnerability Type: Remote executable template supply-chain risk
Risk Level: Medium

Relevant Skill Instructions:

markdown

### Template Safety — IMPORTANT

Templates define the actual cloud infrastructure that will be created. They may contain:
- `remote-exec` provisioners that run arbitrary scripts on created instances
- `user_data` / `cloud-init` scripts that execute on instance boot
- Security group rules that open network ports (e.g., 0.0.0.0/0 ingress)
- `local-exec` provisioners that run commands on your local machine

**Before applying any template, you MUST:**

1. **Inspect the template source** — Run `get_template_info` to view the template's `main.tf`, `variables.tf`, and other files. Read them to understand what resources will be created.
2. **Use `plan_case` first** — This runs `terraform plan` to show a preview of all resources that will be created, modified, or destroyed. Review the plan output before proceeding to `start_case`.
3. **Audit registry templates** — The official template repository is fully open-source at https://github.com/wgpsec/redc-template. Compare pulled templates against the source to ensure they have not been tampered with.
4. **Do NOT blindly apply** — Never run `start_case` without first reviewing the plan. This skill will always use `plan_case` before `start_case` to give you a chance to review.

The associated retrieval and execution workflow is documented as:

markdown

### 3. pull_template

Download a template from the registry.

**Command:**
```bash
redc pull <template_name>

MCP Tool: pull_template

• template_name (string, required): Template name (e.g., "aliyun/ecs" or "aliyun/ecs:1.0.1")
• registry_url (string, optional): Registry base URL
• force (boolean, optional): Force re-download even if template exists

text

### Technical Analysis

The Ski
...[truncated 3386 chars]

Remediation

View remediation

Remediation Suggestions

1. Require immutable template versions rather than allowing mutable or unversioned template names for deployment.
2. Maintain an allowlist of approved templates, versions, registries, and SHA-256 content hashes.
3. Cryptographically verify downloaded templates before inspection or execution. Prefer signed release manifests with a pinned and independently distributed public key.
4. Disable arbitrary registry_url overrides by default. If custom registries are necessary, require explicit user approval and enforce HTTPS with strict certificate validation.
5. Verify every file in a retrieved template against an approved manifest, including referenced scripts, modules, provider lock files, and cloud-init assets.
6. Reject templates containing local-exec or remote-exec by default. Require a separate, explicit confirmation that identifies the exact command and execution context when such provisioners are necessary.
7. Display complete user_data, cloud-init, provisioner commands, external module sources, and network exposure changes during review rather than relying only on summarized Terraform plan output.
8. Run Terraform in an isolated, minimally privileged container or sandbox with restricted filesystem access, no unrelated secrets, and tightly controlled outbound networking.
9. Use short-lived, least-privileged cloud credentials limited to the required project, region, and resource types. Do not expose unrelated provider credentials to the process.
10. Recalculate and verify the approved template hash immediately before start_case so that the reviewed content is exactly the content being applied.
11. Record the registry origin, version, digest, review decision, and applied digest in an auditable deployment log.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

This is a real dangerous capability: the skill explicitly supports pulling and applying Terraform templates that may include local-exec, remote-exec, user_data, and open security group rules, which can execute arbitrary commands locally or on provisioned infrastructure. Although the document warns users to inspect templates and plan before apply, the skill still exposes high-risk deployment and execution functionality in a red-team context, where templates may intentionally create externally reachable offensive infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

### Template Safety — IMPORTANT

Templates define the actual cloud infrastructure that will be created. They may contain:
- `remote-exec` provisioners that run arbitrary scripts on created instances
- `user_data` / `cloud-init` scripts that execute on instance boot
- Security group rules that open network ports (e.g., 0.0.0.0/0 ingress)
- `local-exec` provisioners that run commands on your local machine

Static analysis

No suspicious patterns detected.