CtrlK
BlogDocsLog inGet started
Tessl Logo

cloud-attack-methods

云攻击:元数据API,S3/K8s,AWS/Azure/GCP身份提权,MinIO矩阵,阿里云FC,ChengZi SDK解密。Use when attacking cloud metadata, IAM, K8s, MinIO, Aliyun FC, or cloud post-ex.

72

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

80%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly dense, actionable cheat-sheet of cloud attack techniques that scores well on conciseness and actionability. Its weaknesses are the absence of sequenced workflows with validation checkpoints and a monolithic single-block layout that hinders navigation.

Suggestions

Break the single fenced code block into markdown sections (e.g. '## Metadata APIs', '## MinIO matrix', '## Aliyun FC') so techniques are navigable rather than a wall of text.

For multi-step techniques (e.g. S3 token -> K8s api -> cluster-admin, or FC -> CDN chain), add a numbered sequence with a validation/confirmation checkpoint between steps.

Move detailed tool reference (pacu/roadtools/GraphRunner flags, CVE exploit specifics) into a references/ file and link to it, keeping SKILL.md as a concise overview.

DimensionReasoningScore

Conciseness

The body is a dense, token-efficient reference that assumes Claude's knowledge of the named tools and CVEs; no padded conceptual explanation is present, so every token earns its place.

3 / 3

Actionability

Provides concrete, runnable commands and payloads throughout (e.g. 'aws s3 ls --no-sign-request', 'kubectl auth can-i --list', the MinIO login POST body, 'XOR key=0x96'), going beyond abstract description.

3 / 3

Workflow Clarity

Content is organized by attack category but is a reference matrix, not a sequenced workflow; there are no explicit validation checkpoints or feedback loops for these destructive/exploitative operations.

2 / 3

Progressive Disclosure

Everything sits in a single monolithic fenced code block with no markdown subheadings or references to bundle files (none exist); inline 🚨 labels give some structure, but navigation and content split could be improved.

2 / 3

Total

10

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A concise, specific description that clearly states capabilities and provides an explicit natural-language trigger clause. It avoids fluff and uses third-person voice, with distinct triggers that minimize conflict risk.

DimensionReasoningScore

Specificity

Lists multiple concrete capabilities/targets — '元数据API,S3/K8s,AWS/Azure/GCP身份提权,MinIO矩阵,阿里云FC,ChengZi SDK解密' — naming specific attack domains rather than vague abstractions.

3 / 3

Completeness

Explicitly answers both what ('云攻击:...') and when ('Use when attacking...'), with an explicit trigger clause rather than only implied usage.

3 / 3

Trigger Term Quality

The 'Use when attacking cloud metadata, IAM, K8s, MinIO, Aliyun FC, or cloud post-ex' clause covers natural terms a user would say, with good breadth across the skill's scope.

3 / 3

Distinctiveness Conflict Risk

The cloud-attack niche (metadata, IAM, K8s, MinIO, Aliyun FC, post-ex) is distinct and unlikely to overlap with unrelated skills; triggers are specific to this domain.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
Ed1s0nZ/CyberStrikeAI
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.