cloud-overview

Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/cloud/SKILL.md

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A token-efficient, well-structured catalog with concrete commands and clear routing, weakened mainly by absent validation checkpoints in batch workflow steps and references to undefined audit primitives. It is an excellent overview that points cleanly to detailed sub-skills.

Suggestions

Add validation checkpoints to the workflows (e.g., confirm caller identity before enumerating policies; verify a fetched policy JSON parsed before auditing) to lift workflow clarity above 3.

Define or link the referenced primitives (iam_policy_audit, tfstate_audit, k8s_audit, kg_add_node, plan_attack_chains) so the commands are fully executable rather than relying on external context.

Replace the `<me>` placeholder with an explicit step to capture the current principal from get-caller-identity rather than leaving substitution implicit.

Dimension	Reasoning	Score
Conciseness	The body is lean — a playbooks table and two short numbered workflows with specific commands — and assumes Claude's competence without explaining cloud or privesc concepts it already knows.	5 / 5
Actionability	Provides concrete commands like `bash("aws sts get-caller-identity")` and `metadata_endpoints("aws")`, but references undefined primitives (iam_policy_audit, tfstate_audit, k8s_audit, kg_add_node) and an unsubstituted `<me>` placeholder, leaving minor gaps.	4 / 5
Workflow Clarity	Steps are clearly sequenced in both workflows, but there are no validation/verification checkpoints, and batch steps like 'For each attached policy' lack validation, capping workflow clarity at 3 per the rubric.	3 / 5
Progressive Disclosure	A well-organized catalog under 50 lines: a Playbooks table provides a clear overview with one-level-deep references to sub-skills, and the two workflow sections are cleanly separated for easy navigation.	5 / 5
	Total	17 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A concise, specific description that clearly conveys the cloud-exploitation domain and concrete actions, but it lacks an explicit 'Use when' trigger clause and is slightly thin on synonym/extension coverage. Third-person voice is correctly used throughout.

Suggestions

Add an explicit 'Use when ...' clause naming the trigger scenarios (e.g., 'Use when assessing AWS/GCP/Azure environments for IAM, S3, k8s, or Terraform exposure') to raise completeness above 3.

Broaden trigger terms to include GCP, Azure, SSRF, and 'metadata service' / 'IMDS' synonyms so the description surfaces for non-AWS clouds.

Disambiguate this overview/routing skill from its sub-skills so it is clearly the entry point rather than a competing match.

Dimension	Reasoning	Score
Specificity	Names the domain and lists multiple concrete actions — 'AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting' — giving comprehensive coverage in third person.	5 / 5
Completeness	The 'what' is clear and concrete, but there is no 'Use when...' clause or equivalent explicit trigger guidance in the description, capping completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Includes natural keywords users would say ('cloud', 'AWS', 'IAM', 'S3', 'k8s', 'Terraform', 'metadata') but omits common synonyms/extensions like GCP, Azure, SSRF, or explicit 'privesc' variations beyond the one listed.	4 / 5
Distinctiveness Conflict Risk	The cloud-exploitation lane is a clear niche with distinct triggers, but as a routing/overview skill it carries minor overlap risk with the individual sub-skills it dispatches to and general pentest skills.	4 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/cloud/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.