Compétences cloud-penetration-testing

☁️

cloud-penetration-testing

Name: cloud-penetration-testing
Author: sickn33

Risque faible ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers

クラウドセキュリティ評価の実施

セキュリティ専門家は、Azure、AWS、GCP環境にわたって包括的なクラウドペネトレーションテスト機能が必要です。このスキルは、Reconnaissance、列挙、悪用、永続性テストのための構造化されたワークフロー明確な認可要件を提供します。

Prend en charge: Claude Codex Code(CC)

⚠️ 65 Médiocre

Télécharger le ZIP du skill

Importer dans Claude

Allez dans Paramètres → Capacités → Skills → Importer un skill

Activez et commencez à utiliser

Tester

Utilisation de "cloud-penetration-testing". Enumerate AWS S3 buckets and check for public access

Résultat attendu:

アクセスコントロールを含むS3バケットのリストを返し、公開アクセス可能なバケットを特定し、設定ミスの修正提案を提供

Utilisation de "cloud-penetration-testing". Check Azure AD for users with password in attributes

Résultat attendu:

属性に機密データを含むAzure ADユーザーを返し、どのプロパティに潜在的なシークレットが含まれているか表示

Utilisation de "cloud-penetration-testing". Access GCP metadata service for credential discovery

Résultat attendu:

侵害されたコンピューティングインスタンスからのGCPサービスアカウントトークンとメタデータを返す

Audit de sécurité

Risque faible

v1 • 2/25/2026

This skill contains cloud penetration testing commands and scripts commonly used in authorized security assessments. Static analysis flagged external command execution, network access, and metadata endpoint patterns - all standard elements of legitimate cloud security testing. The skill includes clear authorization requirements and is designed for security professionals. Findings are false positives in this context as they represent standard pen testing techniques for Azure, AWS, and GCP.

Fichiers analysés

826

Lignes analysées

résultats

Total des audits

Problèmes à risque élevé (4)

SKILL.md:20-36 SKILL.md:80-98 SKILL.md:143-174 SKILL.md:253-269 SKILL.md:275-286 SKILL.md:337-395 SKILL.md:443-475 references/advanced-cloud-scripts.md:9-130 references/advanced-cloud-scripts.md:148-190

External Command Execution

Skill contains numerous external command invocations using shell backticks and system() calls. These execute AWS CLI, Azure CLI, and GCP commands for security testing purposes. This is standard penetration testing practice but could be misused.

SKILL.md:263-268 SKILL.md:339-342 SKILL.md:383 SKILL.md:401-402 references/advanced-cloud-scripts.md:120-124

Cloud Metadata Service Access

Skill contains commands to access AWS, Azure, and GCP metadata endpoints (169.254.169.254). This is standard cloud security assessment technique for checking instance credentials and configuration.

SKILL.md:440-451 SKILL.md:181 references/advanced-cloud-scripts.md:242-272

Password Spraying Scripts

Skill contains password spraying tools and scripts for testing credential strength. This is a legitimate security testing technique but could be weaponized for brute force attacks.

SKILL.md:169-174 SKILL.md:259-261 SKILL.md:353-356 SKILL.md:295 SKILL.md:477

Credential Access Techniques

Skill demonstrates techniques for accessing credentials from cloud services including Key Vault secrets, Lambda environment variables, and user data. This is standard cloud security assessment.

Problèmes à risque moyen (2)

SKILL.md:44-74 SKILL.md:100-143 SKILL.md:215-247 SKILL.md:427

Network Reconnaissance

Skill includes network enumeration commands for cloud resources. This is standard reconnaissance for security assessments.

SKILL.md:353-356 SKILL.md:67 SKILL.md:464

Filesystem Access

Skill contains filesystem access commands for credential discovery. This is standard post-exploitation technique in authorized assessments.

Problèmes à risque faible (1)

SKILL.md:176-197 SKILL.md:271-286

Persistence Techniques

Skill documents persistence techniques like creating service principals and backdoor accounts. These are standard post-exploitation techniques documented for authorized assessments.

Facteurs de risque

⚙️ Commandes externes (114)

🌐 Accès réseau (50)

📁 Accès au système de fichiers (5)

SKILL.md:354 SKILL.md:67 SKILL.md:354 SKILL.md:354 SKILL.md:464

Motifs détectés

Code Execution + Network + Credentials

Audité par: claude

Score de qualité

Architecture

100

Maintenabilité

Contenu

Communauté

Sécurité

Conformité aux spécifications

Ce que vous pouvez construire

AWS評価を実施するセキュリティコンサルタント

S3バケット列挙、IAMロール分析、EC2インスタンステストを含む包括的なAWSセキュリティ評価を実施

防御チームメンバーが防御をテスト

攻撃者の技術をシミュレートして組織のクラウドセキュリティコントロールを検証

DevSecOpsエンジニアがクラウドインフラストラクチャを強化

攻撃者が悪用する前にクラウド設定ミスを特定し修正

Essayez ces prompts

基本的なAWS列挙

Use the cloud-penetration-testing skill to enumerate AWS resources. List all S3 buckets, EC2 instances, and IAM users accessible with current credentials. Run: aws sts get-caller-identity first to check authentication.

Azure ADユーザー発見

Use the cloud-penetration-testing skill to enumerate Azure AD users and groups. List all users, groups, and role assignments. Check for users with password in attributes.

GCPプロジェクト評価

Use the cloud-penetration-testing skill to assess GCP security. List enabled services, compute instances, storage buckets, and IAM policies. Check for overly permissive service accounts.

包括的なクラウド監査

Use the cloud-penetration-testing skill to perform a comprehensive multi-cloud security assessment covering AWS, Azure, and GCP. Document all findings with remediation recommendations.

Bonnes pratiques

テスト対象のクラウド環境から常に書面による認可を取得
コンプライアンスのためにすべてのテスト活動と発見を記録
悪用を試みる前に最初に読み取り専用の列挙技術を使用
認可の範囲境界を尊重し、認可外のシステムにアクセスしない

Éviter

Running penetration tests without proper authorization
Testing production systems without notification to operations team
Attempting to access customer data in multi-tenant environments
Ignoring detection and alerting mechanisms during testing

Foire aux questions

Does this skill work with multi-factor authentication?

MFA can limit some attack techniques. The skill documents alternative authentication methods but these require specific conditions to succeed.

Can this skill bypass cloud security controls?

No. This skill provides testing techniques that work within the capabilities of the provided credentials. Properly secured environments will block unauthorized access.

Is password spraying included?

The skill references password spraying tools for credential validation testing. This requires explicit authorization and should only be used in authorized assessments.

Does this skill work offline?

No. Cloud penetration testing requires network access to cloud provider APIs and metadata endpoints.

Can I use this for internal security testing?

Yes, with proper written authorization from the environment owner. Always document the scope and rules of engagement.

What cloud providers are supported?

Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) are all covered with specific techniques for each.