Review tool descriptions for hidden instructions

Pin tool versions and review updates before upgrading

Apply principle of least privilege per tool

Requires API keys or tokens to function. If the tool is compromised, your API keys could be exfiltrated and used for unauthorized access or billing abuse.

• ●Access your API quotas and billing
• ●Impersonate your identity to services
• ●Leak keys to third parties

Can make outbound network requests. A compromised tool can exfiltrate stolen data, download additional payloads, or communicate with command-and-control servers.

• ●Send data to external servers
• ●Download malicious payloads
• ●Establish reverse shells

Can read and write files on your system. Malicious tools can steal SSH keys, credentials, browser data, or modify configuration files.

• ●Read ~/.ssh/*, ~/.aws/credentials
• ●Access browser cookies and passwords
• ●Modify config files or inject code

Can execute arbitrary system commands on your machine. A compromised tool with shell access can install malware, modify system files, or exfiltrate data.

• ●Execute system commands (rm, curl, wget)
• ●Install or remove software
• ●Access other processes and services