Skills cloud-penetration-testing
📦
cloud-penetration-testing
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Assess Cloud Security Posture
Cloud teams need a structured way to test AWS, Azure, and GCP exposure. This skill organizes authorized cloud assessment steps, resource enumeration, and remediation-focused reporting.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "cloud-penetration-testing" from https://skillstore.io/skills/sickn33-cloud-penetration-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-cloud-penetration-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "cloud-penetration-testing". Plan an authorized AWS, Azure, and GCP cloud security assessment.
Expected outcome:
- Scope and authorization checklist.
- Provider-specific enumeration plan.
- Evidence handling and logging notes.
- Report structure with remediation sections.
Using "cloud-penetration-testing". Summarize findings from a cloud IAM review.
Expected outcome:
- High-risk administrator paths and exposed service accounts.
- Medium-risk excessive permissions and stale credentials.
- Recommended least-privilege changes and owner assignments.
Using "cloud-penetration-testing". Turn cloud storage observations into report-ready findings.
Expected outcome:
- Affected buckets and data sensitivity summary.
- Access control issue description.
- Business impact statement.
- Remediation steps and validation plan.
Security Audit
Criticalv5 • 7/9/2026 Open versioned report
Sections are framed as authorized cloud testing, but they include actionable credential harvesting, metadata token retrieval, password spraying, and persistence workflows. I confirmed findings tied to those workflows and dismissed syntax-only Markdown, benign URL, and encryption-status false positives. No prompt injection evidence was found in the reviewed files.
2
Files scanned
821
Lines analyzed
67
Review items
0
False positives ignored
Confirmed security concerns (24)
Critical
GCP credentials directory
sudo cp -r /home/user/.config/gcloud ~/.config
The command copies the GCP credentials directory from another home profile. This is direct credential material access.
Critical
Credential JSON file
gcloud auth activate-service-account --key-file compromised-sa.json
The skill authenticates with a file named compromised-sa.json in a service account compromise example. The context confirms use of stolen credential material.
Critical
Malware type keywords
# Create backdoor service principal
The line explicitly says to create a backdoor service principal. That is persistence guidance in a cloud tenant.
Critical
Malware type keywords
# Create backdoor access key
The line explicitly says to create a backdoor access key. That is persistence guidance for continued AWS access.
Critical
Pipe to shell pattern
curl https://sdk.cloud.google.com | bash
The command pipes a remote installer script directly to bash. This executes network-delivered code without verification.
Critical
[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
This combination is common in credential stealers and RATs
The skill combines command execution, metadata-service access, credential files, password spraying, and persistence guidance. That combination is dangerous in a marketplace skill.
Critical
SKILL.md:167-171SKILL.md:257-266SKILL.md:350-353references/advanced-cloud-scripts.md:116-124references/advanced-cloud-scripts.md:191-204
Credential Harvesting and Data Extraction Workflow
The skill instructs users to dump Key Vault secrets, Lambda environment variables, cloud metadata tokens, service account keys, and local GCP credential stores.
Multiple sections explicitly retrieve secrets, metadata tokens, environment variables, and credential stores. The behavior is credential extraction, not only benign enumeration.
Critical
Persistence and Backdoor Account Creation Guidance
The skill provides workflows to create backdoor service principals, access keys, admin users, and directory role assignments for continued access.
The text names the activity as backdoor creation and shows account, key, and administrator-role creation steps. This is clear persistence guidance.
Show all 24 confirmed findings
High
System reconnaissance
az ad sp credential reset --id <app_id>
The command resets a service principal credential. In the attack path, this supports account takeover and persistence.
High
System reconnaissance
az ad sp credential list --id <app_id>
The command lists service principal credentials after reset. The surrounding workflow uses those credentials for privileged login.
High
Credential JSON file
gcloud auth activate-service-account --key-file creds.json
The skill authenticates with a service account key file named creds.json. Such JSON key files contain sensitive cloud credentials.
High
SQLite database file
sudo find /home -name "credentials.db"
The command searches home directories for credentials.db. In the GCP context, this indicates credential database discovery.
High
System reconnaissance
az keyvault secret show --id <URI>
The command displays a Key Vault secret by URI. In this exploitation section, it is direct secret retrieval, not routine inventory.
High
[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network
This combination could indicate credential harvesting and exfiltration
The skill combines filesystem access, credential stores, cloud APIs, and network endpoints. The context supports credential harvesting and exfiltration risk.
High
Password Spraying With Evasion-Oriented Infrastructure
The skill includes password spraying steps, valid credential collection, and FireProx IP rotation guidance for Azure and Office 365 authentication testing.
The examples invoke password spraying, collect valid credentials, and include IP rotation infrastructure. These are strong indicators of credential attack workflows.
Low
System reconnaissance
$subscriptionid = $s.SubscriptionId
The script selects or records Azure subscription identifiers while iterating accounts. This is legitimate in scope but still cloud reconnaissance.
Low
System reconnaissance
Select-AzSubscription -Subscription $subscriptionid
The script selects or records Azure subscription identifiers while iterating accounts. This is legitimate in scope but still cloud reconnaissance.
Low
System reconnaissance
$subscriptionid = $s.SubscriptionId
The script selects or records Azure subscription identifiers while iterating accounts. This is legitimate in scope but still cloud reconnaissance.
Low
System reconnaissance
Select-AzSubscription -Subscription $subscriptionid
The script selects or records Azure subscription identifiers while iterating accounts. This is legitimate in scope but still cloud reconnaissance.
Low
System reconnaissance
$subscriptionid = $s.SubscriptionId
The script selects or records Azure subscription identifiers while iterating accounts. This is legitimate in scope but still cloud reconnaissance.
Low
System reconnaissance
Select-AzSubscription -Subscription $subscriptionid
The script selects or records Azure subscription identifiers while iterating accounts. This is legitimate in scope but still cloud reconnaissance.
Low
Network reconnaissance
aws ec2 describe-instances --query=Reservations[].Instances[].PublicIpAddress --region $r | jq -r '.
The command enumerates public cloud addresses or database DNS names. That is network reconnaissance within a cloud assessment workflow.
Low
Network reconnaissance
aws rds describe-db-instances --query=DBInstances[*].Endpoint.Address --region $r | jq -r '.[]' >> r
The command enumerates public cloud addresses or database DNS names. That is network reconnaissance within a cloud assessment workflow.
Low
Network reconnaissance
aws ec2 describe-instances --query=Reservations[].Instances[].PublicIpAddress --region $region | jq
The command enumerates EC2 public IP addresses across regions. This is cloud network reconnaissance within the skill workflow.
Capability review items (67)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
PowerShell invocation
```powershell
The PowerShell block accesses Azure metadata and managed identity token endpoints. That can expose cloud credentials from a VM.
Critical
AWS/Azure metadata endpoint
Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01
The snippet accesses the Azure instance metadata service to retrieve identity tokens or instance metadata. That can expose cloud credentials from a compromised VM.
Critical
AWS/Azure metadata endpoint
$instance = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/instance?api-version=2018-02-01'
The snippet accesses the Azure instance metadata service to retrieve identity tokens or instance metadata. That can expose cloud credentials from a compromised VM.
Critical
Hardcoded URL
Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01
The hardcoded URL is the cloud metadata service, not a normal public endpoint. Accessing it can disclose identity tokens and sensitive instance data.
Critical
Hardcoded URL
$instance = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/instance?api-version=2018-02-01'
The hardcoded URL is the cloud metadata service, not a normal public endpoint. Accessing it can disclose identity tokens and sensitive instance data.
Critical
Hardcoded IP address
Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01
The hardcoded IP is 169.254.169.254, the cloud metadata service. The surrounding commands retrieve managed identity or instance metadata.
Critical
Hardcoded IP address
$instance = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/instance?api-version=2018-02-01'
The hardcoded IP is 169.254.169.254, the cloud metadata service. The surrounding commands retrieve managed identity or instance metadata.
Critical
Shell command substitution
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-secon
The command substitution stores an IMDSv2 token obtained from the AWS metadata service. That token enables subsequent metadata access for role credential discovery.
Critical
PowerShell invocation
```powershell
The PowerShell persistence block creates a backdoor service principal and adds it to Global Admin. This is explicit persistence guidance.
Critical
sudo privilege escalation
sudo find /home -name "credentials.db"
The sudo command searches all home directories for GCP credential databases. That is privileged credential discovery across user profiles.
Critical
sudo privilege escalation
sudo cp -r /home/user/.config/gcloud ~/.config
The sudo command copies a user GCP configuration directory into the current user profile. That can transfer active cloud credentials.
Critical
AWS/Azure metadata endpoint
curl http://169.254.169.254/latest/meta-data/
The finding points to AWS or Azure metadata-service access. In this context, the skill uses it to retrieve metadata or role credentials from cloud instances.
Critical
AWS/Azure metadata endpoint
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
The finding points to AWS or Azure metadata-service access. In this context, the skill uses it to retrieve metadata or role credentials from cloud instances.
Critical
AWS/Azure metadata endpoint
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-secon
The finding points to AWS or Azure metadata-service access. In this context, the skill uses it to retrieve metadata or role credentials from cloud instances.
Critical
AWS/Azure metadata endpoint
curl http://169.254.169.254/latest/meta-data/profile -H "X-aws-ec2-metadata-token: $TOKEN"
The finding points to AWS or Azure metadata-service access. In this context, the skill uses it to retrieve metadata or role credentials from cloud instances.
Critical
AWS/Azure metadata endpoint
| Metadata | `curl http://169.254.169.254/latest/meta-data/` |
The finding points to AWS or Azure metadata-service access. In this context, the skill uses it to retrieve metadata or role credentials from cloud instances.
Critical
AWS/Azure metadata endpoint
| AWS | `http://169.254.169.254/latest/meta-data/` |
The finding points to AWS or Azure metadata-service access. In this context, the skill uses it to retrieve metadata or role credentials from cloud instances.
Critical
AWS/Azure metadata endpoint
| Azure | `http://169.254.169.254/metadata/instance?api-version=2018-02-01` |
The finding points to AWS or Azure metadata-service access. In this context, the skill uses it to retrieve metadata or role credentials from cloud instances.
Critical
AWS/Azure metadata endpoint
| Metadata service blocked | Check IMDSv2 (AWS); verify instance role; check firewall for 169.254.16
The finding points to AWS or Azure metadata-service access. In this context, the skill uses it to retrieve metadata or role credentials from cloud instances.
Critical
GCP metadata endpoint
curl "http://metadata.google.internal/computeMetadata/v1/?recursive=true&alt=text" -H "Metadata-Flav
The finding points to the GCP metadata service. The surrounding section retrieves metadata and service-account scopes from compute instances.
Critical
GCP metadata endpoint
curl http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/scopes -H
The finding points to the GCP metadata service. The surrounding section retrieves metadata and service-account scopes from compute instances.
Critical
GCP metadata endpoint
| Metadata | `curl -H "Metadata-Flavor: Google" http://metadata.google.internal/...` |
The finding points to the GCP metadata service. The surrounding section retrieves metadata and service-account scopes from compute instances.
Critical
GCP metadata endpoint
| GCP | `http://metadata.google.internal/computeMetadata/v1/` |
The finding points to the GCP metadata service. The surrounding section retrieves metadata and service-account scopes from compute instances.
Critical
Hardcoded URL
curl https://sdk.cloud.google.com | bash
The URL is used in a curl-to-bash installation command. The risk is remote script execution from a network endpoint.
Critical
Hardcoded URL
curl http://169.254.169.254/latest/meta-data/
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-secon
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
curl http://169.254.169.254/latest/meta-data/profile -H "X-aws-ec2-metadata-token: $TOKEN"
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
curl "http://metadata.google.internal/computeMetadata/v1/?recursive=true&alt=text" -H "Metadata-Flav
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
curl http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/scopes -H
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
| Metadata | `curl http://169.254.169.254/latest/meta-data/` |
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
| Metadata | `curl -H "Metadata-Flavor: Google" http://metadata.google.internal/...` |
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
| AWS | `http://169.254.169.254/latest/meta-data/` |
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
| Azure | `http://169.254.169.254/metadata/instance?api-version=2018-02-01` |
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded URL
| GCP | `http://metadata.google.internal/computeMetadata/v1/` |
The hardcoded URL is a cloud metadata endpoint or metadata command. These endpoints can reveal identity, scope, or credential material from instances.
Critical
Hardcoded IP address
curl http://169.254.169.254/latest/meta-data/
The hardcoded IP is the cloud metadata service address. The skill context uses it for metadata or credential discovery.
Critical
Hardcoded IP address
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
The hardcoded IP is the cloud metadata service address. The skill context uses it for metadata or credential discovery.
Critical
Hardcoded IP address
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-secon
The hardcoded IP is the cloud metadata service address. The skill context uses it for metadata or credential discovery.
Critical
Hardcoded IP address
curl http://169.254.169.254/latest/meta-data/profile -H "X-aws-ec2-metadata-token: $TOKEN"
The hardcoded IP is the cloud metadata service address. The skill context uses it for metadata or credential discovery.
Critical
Hardcoded IP address
| Metadata | `curl http://169.254.169.254/latest/meta-data/` |
The hardcoded IP is the cloud metadata service address. The skill context uses it for metadata or credential discovery.
Critical
Hardcoded IP address
| AWS | `http://169.254.169.254/latest/meta-data/` |
The hardcoded IP is the cloud metadata service address. The skill context uses it for metadata or credential discovery.
Critical
Hardcoded IP address
| Azure | `http://169.254.169.254/metadata/instance?api-version=2018-02-01` |
The hardcoded IP is the cloud metadata service address. The skill context uses it for metadata or credential discovery.
Critical
Hardcoded IP address
| Metadata service blocked | Check IMDSv2 (AWS); verify instance role; check firewall for 169.254.16
The hardcoded IP is the cloud metadata service address. The skill context uses it for metadata or credential discovery.
Critical
Hidden file in home directory
sudo cp -r /home/user/.config/gcloud ~/.config
The path targets /home/user/.config/gcloud and copies it into ~/.config. This is direct access to hidden cloud credential configuration.
Critical
Hidden file access
sudo cp -r /home/user/.config/gcloud ~/.config
The hidden path is the GCP configuration directory. Copying it can expose OAuth tokens and service account state.
High
PowerShell invocation
```powershell
The PowerShell block contains cloud enumeration or export automation across subscriptions. These commands can expose cloud assets and operational data if run out of scope.
High
PowerShell invocation
```powershell
The PowerShell block contains cloud enumeration or export automation across subscriptions. These commands can expose cloud assets and operational data if run out of scope.
High
PowerShell invocation
```powershell
The PowerShell block contains cloud enumeration or export automation across subscriptions. These commands can expose cloud assets and operational data if run out of scope.
High
PowerShell invocation
```powershell
The PowerShell block contains cloud enumeration or export automation across subscriptions. These commands can expose cloud assets and operational data if run out of scope.
High
PowerShell invocation
```powershell
The PowerShell block implements device-code authentication or token retrieval. In this context, it can obtain cloud access tokens.
High
PowerShell invocation
```powershell
The PowerShell block implements device-code authentication or token retrieval. In this context, it can obtain cloud access tokens.
High
PowerShell invocation
## Password Spraying with Az PowerShell
The section is password spraying with Azure PowerShell and writes valid credentials. This is actionable credential attack guidance.
High
PowerShell invocation
```powershell
The section is password spraying with Azure PowerShell and writes valid credentials. This is actionable credential attack guidance.
High
Hardcoded URL
-Uri "https://login.microsoftonline.com/common/oauth2/devicecode?api-version=1.0" `
The URL initiates an OAuth device-code login flow. In this pentesting context, that can be used to obtain cloud access tokens.
High
Hardcoded URL
-Uri "https://login.microsoftonline.com/Common/oauth2/token?api-version=1.0" `
The URL retrieves OAuth tokens after device-code authentication. The surrounding script stores tokens for cloud access.
High
Hardcoded URL
az rest --method POST --uri https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignment
The URL is used for a Microsoft Graph role assignment POST. The surrounding service principal attack path adds privileged directory access.
High
PowerShell invocation
```powershell
The PowerShell authentication block includes importing a stolen context and saving access tokens. That is risky credential handling.
High
PowerShell invocation
# Az PowerShell Module
The Azure PowerShell module block includes credential-based authentication and token context handling. It can enable risky cloud access workflows.
High
PowerShell invocation
```powershell
The PowerShell block enumerates Azure subscriptions, users, groups, roles, VMs, storage, and databases. This is cloud reconnaissance guidance.
High
PowerShell invocation
```powershell
The PowerShell exploitation block searches user attributes for passwords and leads into secret dumping. That is credential discovery guidance.
High
PowerShell invocation
Invoke-AzVMRunCommand -ResourceGroupName $RG -VMName $VM -CommandId RunPowerShellScript -ScriptPath
The command runs a PowerShell script on an Azure VM. Remote command execution in a cloud VM is high-risk even during testing.
High
PowerShell invocation
```powershell
The PowerShell example invokes MSOLSpray for password spraying. It is actionable credential attack guidance.
High
sudo privilege escalation
unzip awscliv2.zip && sudo ./aws/install
The command runs an installer with sudo after downloading the AWS CLI archive. It is a legitimate install pattern, but it still executes privileged code on the host.
High
Hardcoded URL
python fire.py --access_key <key> --secret_access_key <secret> --region us-east-1 --url https://logi
The URL is used with FireProx setup for Azure login traffic. The surrounding example supports password spraying with IP rotation.
High
Hardcoded URL
Invoke-MSOLSpray -UserList .\users.txt -Password "Spring2024!" -URL https://<api-gateway>.execute-ap
The URL is used by MSOLSpray in a password spraying example. This supports credential attack automation.
Low
Hardcoded URL
curl "https://login.microsoftonline.com/getuserrealm.srf?login=user@target.com&xml=1"
The URL queries Microsoft tenant realm information for a target login. It is reconnaissance against cloud identity infrastructure.
Low
Hardcoded URL
curl "https://login.microsoftonline.com/target.com/v2.0/.well-known/openid-configuration"
The URL retrieves OpenID configuration for a target tenant. It is cloud identity reconnaissance, although the endpoint is public.
Risk Factors
⚙️ External commands (50)
references/advanced-cloud-scripts.md:89-90 references/advanced-cloud-scripts.md:91-92 references/advanced-cloud-scripts.md:108-109 references/advanced-cloud-scripts.md:110-111 references/advanced-cloud-scripts.md:259-265 references/advanced-cloud-scripts.md:9 references/advanced-cloud-scripts.md:28 references/advanced-cloud-scripts.md:50 references/advanced-cloud-scripts.md:59 references/advanced-cloud-scripts.md:80 references/advanced-cloud-scripts.md:101 references/advanced-cloud-scripts.md:118 references/advanced-cloud-scripts.md:242 references/advanced-cloud-scripts.md:244 SKILL.md:18-34 SKILL.md:34-60 SKILL.md:60-72 SKILL.md:72-78 SKILL.md:78-96 SKILL.md:96-102 SKILL.md:102-141 SKILL.md:141-147 SKILL.md:147-172 SKILL.md:172-178 SKILL.md:178-195 SKILL.md:195-201 SKILL.md:201-211 SKILL.md:211-217 SKILL.md:217-245 SKILL.md:245-251 SKILL.md:251-267 SKILL.md:267-273 SKILL.md:273-284 SKILL.md:284-290 SKILL.md:290-329 SKILL.md:329-335 SKILL.md:335-354 SKILL.md:354-362 SKILL.md:362-363 SKILL.md:363-364 SKILL.md:364-365 SKILL.md:365-366 SKILL.md:366-367 SKILL.md:367-368 SKILL.md:368-369 SKILL.md:369-375 SKILL.md:375-376 SKILL.md:376-377 SKILL.md:377-378 SKILL.md:378-379
🌐 Network access (48)
references/advanced-cloud-scripts.md:120 references/advanced-cloud-scripts.md:123 references/advanced-cloud-scripts.md:83 references/advanced-cloud-scripts.md:91 references/advanced-cloud-scripts.md:110 references/advanced-cloud-scripts.md:120 references/advanced-cloud-scripts.md:123 references/advanced-cloud-scripts.md:289 references/advanced-cloud-scripts.md:85 references/advanced-cloud-scripts.md:120 references/advanced-cloud-scripts.md:123 SKILL.md:261 SKILL.md:262 SKILL.md:265 SKILL.md:266 SKILL.md:381 SKILL.md:399 SKILL.md:400 SKILL.md:496 SKILL.md:337 SKILL.md:340 SKILL.md:393 SKILL.md:401 SKILL.md:25 SKILL.md:29 SKILL.md:62 SKILL.md:65 SKILL.md:261 SKILL.md:262 SKILL.md:265 SKILL.md:266 SKILL.md:337 SKILL.md:340 SKILL.md:381 SKILL.md:393 SKILL.md:399 SKILL.md:400 SKILL.md:401 SKILL.md:444 SKILL.md:448 SKILL.md:261 SKILL.md:262 SKILL.md:265 SKILL.md:266 SKILL.md:381 SKILL.md:399 SKILL.md:400 SKILL.md:496
📁 Filesystem access (4)
Detected Patterns
System reconnaissance×9Network reconnaissance×3GCP credentials directoryMalware type keywords×2Pipe to shell pattern[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-cloud-penetration-testing/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-cloud-penetration-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-cloud-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-cloud-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-cloud-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). cloud-penetration-testing security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-cloud-penetration-testing/audits/5BibTeX citation
@techreport{sickn33-sickn33-cloud-penetration-testing-2026,
author = {sickn33},
title = {cloud-penetration-testing security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-cloud-penetration-testing/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cloud-penetration-testing security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-cloud-penetration-testing/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-cloud-penetration-testing:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 41
Architecture
85
Maintainability
87
Content
70
Community
78
Spec Compliance
What You Can Build
Prepare an Authorized Cloud Audit
Define scope, prerequisites, target platforms, expected deliverables, and evidence collection for a cloud assessment.
Review Cloud IAM Exposure
Enumerate identities, roles, policies, subscriptions, projects, and service principals to find risky access paths.
Document Misconfiguration Findings
Turn resource enumeration and secret exposure checks into clear findings with risk ratings and remediation actions.
Try These Prompts
Plan a Cloud Assessment
Create an authorized cloud security assessment plan for AWS, Azure, and GCP. Include prerequisites, scope controls, deliverables, and evidence handling.
Build an Enumeration Checklist
Build a safe enumeration checklist for an approved cloud account. Cover IAM, compute, storage, databases, networking, and logging.
Analyze Assessment Evidence
Review these authorized cloud assessment notes and group findings by severity, affected service, business impact, and remediation priority.
Create a Remediation Report
Draft a cloud penetration test report for an authorized engagement. Include executive summary, technical findings, evidence summaries, and remediation steps.
Best Practices
- Confirm written authorization, scope, and rules of engagement before any testing step.
- Use least-privileged test accounts and record all commands, timestamps, and affected resources.
- Prefer read-only validation and sanitized evidence over copying secrets or customer data.
Avoid
- Using the skill against accounts, tenants, projects, or users outside the approved scope.
- Running persistence, credential extraction, or password spraying steps in production without explicit approval.
- Saving tokens, secrets, or customer data in local files without encryption and retention limits.
Frequently Asked Questions
Is this skill for authorized testing only?
Yes. It should only be used with written authorization, defined scope, and approved rules of engagement.
Which cloud providers does it cover?
It covers assessment workflows for AWS, Microsoft Azure, Google Cloud Platform, and related identity services.
Does it install tools automatically?
No. It lists common tools and commands, but users must manage installation, trust, and change control.
Can it replace a professional cloud audit?
No. It provides structure and examples, but expert review is required for scope, safety, and final risk decisions.
What evidence should users collect?
Users should collect minimal proof, affected resource names, configuration state, timestamps, and remediation validation notes.
What makes this skill high risk?
It includes examples for credential discovery, metadata access, password spraying, and persistence that can be misused.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/cloud-penetration-testingRef
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
7 downloads · 210 views
File structure