cloud-security
Cloud Security targets identity and access control weaknesses across major cloud platforms. It covers IAM privilege escalation, credential harvesting via metadata SSRF, Entra device-code attacks, GCP service-account impersonation chains, Kubernetes container breakout, and CI/CD federation trust abuse. Includes scripts and references for reconnaissance, exploitation, and lateral movement within cloud environments.
Cloud Security exploits AWS, Azure, and GCP IAM misconfigurations, metadata theft, and container escapes for privilege escalation.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Cloud Security exploits AWS, Azure, and GCP IAM misconfigurations, metadata theft, and container escapes for privilege escalation. Cloud Security targets identity and access control weaknesses across major cloud platforms. It covers IAM privilege escalation, credential harvesting via metadata SSRF, Entra device-code attacks, GCP service-account impersonation chains, Kubernetes container breakout, and CI/CD federation trust abuse. Includes scripts and references for reconnaissance, exploitation, and lateral movement within cloud environments.
Use it when
- Cloud Security treats credential harvesting via SSRF and metadata endpoints as a core focus (0.24 weight).
- Cloud Security includes assessment of Kubernetes and container security for breakout paths (0.2 weight).
Verify before relying
Read SKILL.md below before installing (13 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/cloud-security · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What AWS IAM privilege escalation techniques does Cloud Security cover?
Cloud Security addresses AWS IAM privilege escalation as its highest-weighted intent (0.28). The skill covers misconfigurations in IAM policies that enable attackers to escalate privileges, including cross-account privilege escalation paths and techniques for exploiting overly permissive role assumptions. It provides reconnaissance and exploitation references for identifying and leveraging these weaknesses in AWS environments.
How does Cloud Security help with IMDS metadata SSRF credential theft?
Cloud Security treats credential harvesting via SSRF and metadata endpoints as a core focus (0.24 weight). The skill documents how attackers exploit Server-Side Request Forgery to access cloud metadata services—such as AWS IMDS, Azure metadata endpoints, and GCP metadata servers—to steal temporary credentials and service account tokens for lateral movement and privilege escalation.
What container security assessment capabilities does Cloud Security provide?
Cloud Security includes assessment of Kubernetes and container security for breakout paths (0.2 weight). It covers container escape exploits, EKS node credential lateral movement, and Kubernetes RBAC privilege escalation techniques. The skill helps identify misconfigurations that allow attackers to break out of containers and move laterally within Kubernetes clusters.
Does Cloud Security address CI/CD and IaC federation trust abuse?
Yes. Cloud Security covers abuse of CI/CD and Infrastructure-as-Code federation trust policies (0.18 weight), including OIDC federation trust exploitation and Terraform state secrets extraction. It documents how attackers can abuse trust relationships between CI/CD systems and cloud identity providers to gain unauthorized access and escalate privileges.
What cloud platforms does Cloud Security red team assessment cover?
Cloud Security performs red team assessments across AWS, Azure, and GCP (0.1 weight). It includes Azure Entra device-code phishing attacks, GCP service account impersonation chains and actAs attacks, and Azure managed identity escalation. The skill provides cross-platform reconnaissance and exploitation guidance for comprehensive cloud security testing.
What license does Cloud Security use?
Cloud Security is released under the MIT license, allowing broad use, modification, and distribution for both commercial and non-commercial purposes.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: cloud-security description: Use when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuse metadata: type: offensive phase: exploitation tools: pacu, cloudfox, scoutsuite, prowler, trivy, kubectl, aws-cli, az-cli, gcloud, peirates, mkat, azurehound, roadtools, stratus-red-team, kube-bench mitre: [T1078.004, T1552.005, T1098.001, T1528, T1611, T1548] kill_chain: phase: [recon, exploit] step: [1, 4] attck_tactics: [TA0043, TA0001, TA0004, TA0008, TA0006] attck_techniques: [T1078.004, T1552.005, T1552.007, T1098.001, T1098.003, T1528, T1606.002, T1611, T1610, T1134.001, T1548, T1538] depends_on: [recon-osint] feeds_into: [exploit-development, active-directory-attack, advanced-redteam] inputs: [cloud_config, iam_policies, kubeconfig, ci_cd_config] outputs: [cloud_misconfig_list, finding_record, attack_path, stolen_credentials] references: - references/aws-iam-privesc.md - references/imds-metadata-ssrf.md - references/azure-entra-attacks.md - references/gcp-attacks.md -
(truncated - see the full file via the links below)
File tree — 13 files
skills/cloud-security/SKILL.md
skills/cloud-security/references/aws-iam-privesc.md
skills/cloud-security/references/azure-entra-attacks.md
skills/cloud-security/references/gcp-attacks.md
skills/cloud-security/references/iac-secrets-ci-cd.md
skills/cloud-security/references/imds-metadata-ssrf.md
skills/cloud-security/references/kubernetes-container-escape.md
skills/cloud-security/scripts/aws_privesc_enum.py
skills/cloud-security/scripts/entra_device_code_phish.py
skills/cloud-security/scripts/gcp_impersonation_mapper.py
skills/cloud-security/scripts/imds_harvester.py
skills/cloud-security/scripts/k8s_can_i_abuse.py
skills/cloud-security/scripts/oidc_trust_auditor.py
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Exploit cloud IAM misconfigurations for privilege escalation”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill provides Terraform modules for deploying Materialize across AWS (EKS), Azure (AKS), and GCP (GKE), handling cloud infrastructure, Kubernetes setup, and instance configuration. Use it to build networking, databases, storage, and the Materialize operator stack, or to troubleshoot and upgrade existing deployments.
Incident Response guides evidence collection and analysis during active security breaches across endpoints, memory, logs, and cloud environments. It covers triage acquisition with Velociraptor and KAPE, memory forensics via Volatility 3, Windows event-log timelining with Chainsaw and Hayabusa, anti-forensics detection including timestomping, cloud identity-plane attacks, and ransomware or ESXi hypervisor response.
Orchestrate post-compromise domain exploitation through Kerberos attacks, coercion-relay chains, certificate template abuse, and BloodHound-guided lateral movement. Covers roasting, delegation abuse, NTLM reflection, ADCS ESC variants, ticket forgery, DCSync, and dMSA BadSuccessor attacks with integrated OPSEC and detection guidance.
Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.
Threat Hunting equips you to conduct hypothesis-driven threat investigations across Windows endpoints, network traffic, and cloud identity using Sigma-based detection rules, MITRE ATT&CK mapping, and offline triage tools. Execute C2 hunting via JA4 fingerprinting and beaconing analysis, detect post-exploitation techniques like LSASS dumping and LOLBin abuse, and validate detection coverage with purple-team emulation.
This skill guides you through five core workflows: securing new buckets, auditing existing configurations, remediating findings, configuring encryption, and enabling monitoring. It enforces layered security controls aligned with AWS Well-Architected principles, including versioning, encryption defaults, HTTPS-only policies, and attribute-based access control.
More skills privesc-windows (MIT) · windows-boundaries (MIT) · windows-mitigations-bypass (MIT)