cloud-penetration-testing

Block requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal). Implement URL validation that rejects private IP ranges and cloud metadata addresses.

Likely FP if the match is in documentation explaining cloud security concepts or SSRF prevention rather than actual code making metadata requests.

Block requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal). Implement URL validation that rejects private IP ranges and cloud metadata addresses.

Likely FP if the match is in documentation explaining cloud security concepts or SSRF prevention rather than actual code making metadata requests.

Block requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal). Implement URL validation that rejects private IP ranges and cloud metadata addresses.

Likely FP if the match is in documentation explaining cloud security concepts or SSRF prevention rather than actual code making metadata requests.

Download the file first, verify its integrity (checksum, signature), inspect it, then run it. Prefer package managers over raw downloads. Never fetch-and-run in one step.

Likely FP if the target is a well-known installer (e.g., rustup, Homebrew) from its canonical HTTPS domain, though the pattern is inherently risky.

Download the script first, inspect it, verify its checksum, then run it. Do not pipe curl/wget output directly to sh/bash. Prefer package manager installs.

Likely FP if the download is from a well-known installer domain (e.g., brew.sh, rustup.rs), though this pattern is inherently risky even with trusted sources.

Block requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal). Implement URL validation that rejects private IP ranges and cloud metadata addresses.

Likely FP if the match is in documentation explaining cloud security concepts or SSRF prevention rather than actual code making metadata requests.

Block requests to internal service discovery endpoints (consul, etcd, kubernetes API). Implement network segmentation between the agent and internal infrastructure services.

Likely FP if the match is documentation about service discovery architecture without actual code that queries these endpoints.

Block access to cloud instance metadata services using IMDSv2 token requirements, network rules, or iptables. This is a critical vector for credential theft in cloud environments.

Likely FP if the match is in security documentation explaining how to protect against SSRF/IMDS attacks rather than code that accesses the metadata service.

Block requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal). Implement URL validation that rejects private IP ranges and cloud metadata addresses.

Likely FP if the match is in documentation explaining cloud security concepts or SSRF prevention rather than actual code making metadata requests.

Block requests to internal service discovery endpoints (consul, etcd, kubernetes API). Implement network segmentation between the agent and internal infrastructure services.

Likely FP if the match is documentation about service discovery architecture without actual code that queries these endpoints.

Block requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal). Implement URL validation that rejects private IP ranges and cloud metadata addresses.

Likely FP if the match is in documentation explaining cloud security concepts or SSRF prevention rather than actual code making metadata requests.

Block requests to internal service discovery endpoints (consul, etcd, kubernetes API). Implement network segmentation between the agent and internal infrastructure services.

Likely FP if the match is documentation about service discovery architecture without actual code that queries these endpoints.

Block requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal). Implement URL validation that rejects private IP ranges and cloud metadata addresses.

Likely FP if the match is in documentation explaining cloud security concepts or SSRF prevention rather than actual code making metadata requests.

Block requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal). Implement URL validation that rejects private IP ranges and cloud metadata addresses.

Likely FP if the match is in documentation explaining cloud security concepts or SSRF prevention rather than actual code making metadata requests.

Break chained commands into discrete, individually validated steps. Avoid piping untrusted output directly into a shell interpreter.

Likely FP if the matched text is a documentation example showing a common installer one-liner for a well-known tool with a canonical URL.

Verify the integrity of downloaded binaries or archives using SHA-256 checksums or GPG signatures. Pin download URLs to specific versions and avoid fetching from unverified sources.

Likely FP if the download is from github.com or githubusercontent.com for a specific tagged release with documented checksums.

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.