Skills for Real Engineers. Straight from my .agents directory.
39 skills
cloud-iam-deep
Agent skill from
Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.
How to install cloud-iam-deep
install cloud-iam-deep
# install the Claude-BugHunter pack with the skills CLI
npx skills add elementalsouls/Claude-BugHunter# or add only this skill to Claude Code: copy the folder
skills/cloud-iam-deep/
# into
~/.claude/skills/cloud-iam-deep/ (all projects)
.claude/skills/cloud-iam-deep/ (one project)
1## When to use23Trigger when:4- A cloud credential surfaces (key, secret, token, JSON file)5- SSRF chain reaches IMDS / metadata endpoint6- APK / git-leak reveals embedded cloud key7- Recon shows public S3/GCS/Azure-blob with permissions you can verify8- A Kubernetes API or service-account token is exposed9- Post-RCE on a cloud-hosted instance — pivot to cloud control plane1011Do NOT use for:12- On-prem-only environments (use AD attack skills — but those are out of scope per external-only boundary)13- Web2 vulns that happen to be on AWS — use the relevant `hunt-*` skill1415---1617## Credential identification (first 60 seconds)1819```bash20# AWS access key patterns21AKIA[0-9A-Z]{16} # IAM user access key (long-term)22ASIA[0-9A-Z]{16} # STS temporary credential23AGPA[0-9A-Z]{16} # IAM group24AIDA[0-9A-Z]{16} # IAM user (user-id)25AROA[0-9A-Z]{16} # IAM role26ANPA[0-9A-Z]{16} # Managed policy2728# AWS secret pattern (40-char base64-ish — context required)29[A-Za-z0-9/+=]{40} # AWS secret access key3031# Azure32AccountKey=[A-Za-z0-9+/=]{86} # Storage account key33client_secret pattern + UUID # Azure AD app credential3435# GCP service account JSON36{37 "type": "service_account",38 "project_id": "...",39 "private_key_id": "...",40 "private_key": "-----BEGIN PRIVATE KEY-----..."41}4243# K8s SA token (JWT format — decode to confirm)44eyJhbGciOiJSUzI1... # decode kid claim to see issuer45```4647---48…
Excerpt shown under the repository's MIT license.
More skills in Claude-BugHunter
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
Public repository for Agent Skills
20 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills
Production-grade engineering skills for AI coding agents.
CCCXCU25 skills
The 1st Collaborative AI Design Agent Workspace. Local-first and open source. Create motion, prototypes, websites, apps, dashboards, presentations, images, and videos with your team and AI agents. Share work, exchange feedback, and iterate together in one workspace.
40 skills