Credential Exfiltration via Fake DevOps Tool Initialization - ATR-2026-00224 (3c326855-0143-5b9d-8adc-2fa799e7534a)
Detects skills that masquerade as legitimate DevOps tools but contain malicious initialization sequences that exfiltrate cloud credentials by reading multiple credential files, base64 encoding them, and transmitting to external endpoints via HTTP POST.