Conciseness

The body is dense with command tables and permission-to-escalation mappings and contains no concept tutorials or padding; even the framing blockquote earns its place by defining what counts as a finding. The only near-trimmable text is a one-line safety reminder that slightly duplicates the authorization checklist.

Actionability

Commands are executable with exact flags and headers (e.g. 'aws sts get-caller-identity', the IMDSv2 token PUT with 'X-aws-ec2-metadata-token-ttl-seconds: 21600', 'gcloud auth activate-service-account --key-file=sa.json', 'az role assignment list --assignee <objectId> --all'), and each privesc table row gives a specific action for the permission held. Section 0's 'curl .../' shorthand is fully resolved by section 2's literal URLs, so the guidance is copy-paste ready for the common cases.

Workflow Clarity

The sequence is gated and explicit: authorization checklist with 'Stop here if any box is unchecked', identify-the-identity first, per-cloud enumeration before any state change, and a mandatory report line requiring demonstrated impact ('show get-caller-identity after the escalation'). Feedback loops are present ('Got temp creds → jump to section 1/3/4', 'Each secret → re-run identify the identity for the NEW credential. Chain until you hit admin or crown-jewel data'), as is error recovery ('No IAM read? Brute the effective perms with enumerate-iam'), so the destructive-operation cap does not apply.

Progressive Disclosure

A single well-organized file with clear numbered sections, checklists, and no dead-end or buried references; cross-skill pointers (cloud-recon, web2-vuln-classes) are clearly signaled. It misses a 5 because the skill exceeds the under-50-line simple-skill exception and the per-cloud technique tables are the kind of material that could be split into references/ files as the skill grows.

Specificity

The description names the domain and a comprehensive list of concrete capabilities: 'IAM enumeration and privilege escalation (iam:PassRole, CreatePolicyVersion, AssumeRole chains, GCP service-account impersonation, Azure managed-identity abuse)', 'IMDSv1/v2 metadata credential theft', 'S3/GCS/Blob bucket takeover and object exfil', 'Lambda/Cloud Functions env-var secrets', and 'turning leaked keys into demonstrated impact'. Coverage spans all three clouds with named permissions, matching the comprehensive 5 anchor; there are no minor gaps that would justify a 4.

Completeness

Both parts are explicit: the 'what' is stated in the opening two sentences ('Post-access cloud exploitation for AWS, GCP, and Azure — what to do AFTER you obtain credentials or reach a metadata endpoint. Covers…'), and the 'when' is a concrete trigger clause: 'Use when you have AWS/GCP/Azure keys, an SSRF hitting 169.254.169.254 / metadata.google.internal, a leaked service-account JSON, or a token, and need to escalate and prove impact.'

Trigger Term Quality

Natural trigger phrases users would actually say are comprehensively covered with synonyms: 'AWS/GCP/Azure keys', 'leaked keys', 'SSRF', 'a leaked service-account JSON', 'a token', 'metadata endpoint', 'privilege escalation', plus literal transcript strings ('169.254.169.254 / metadata.google.internal') and Chinese trigger words (云渗透、AWS提权、IAM枚举、元数据凭证). This exceeds the 4 anchor, which expects a few natural terms missing.

Distinctiveness Conflict Risk

A clear niche (post-access exploitation, not recon or entry-point discovery) with explicit routing to neighbors: 'For finding buckets/origins first, use cloud-recon; for the SSRF entry point, see web2-vuln-classes.' The named permissions and metadata endpoints are unambiguous triggers, so conflict risk with adjacent skills is minimal.