cloud-iam-deep

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with real CLI one-liners and escalation tables across AWS/Azure/GCP/K8s plus a thorough Cognito chain, but it is a long monolithic file that re-explains some concepts Claude already knows and lacks explicit validation feedback loops for destructive IAM operations.

Suggestions

Split the large reference material (tooling table, privesc pattern tables, the six cited Cognito writeups) into files under references/ and keep SKILL.md as a concise overview pointing one level deep, which would lift progressive_disclosure.

Remove or compress Claude-already-knows exposition such as the User Pools vs Identity Pools primer and the IMDSv2 server-fetcher narration to improve conciseness.

Add explicit validate→fix→retry checkpoints around destructive IAM operations (e.g. after role-trust modification or AssumeRole chaining) to move workflow_clarity above 2.

Dimension	Reasoning	Score
Conciseness	Mostly efficient command/table-driven prose, but includes concepts Claude already knows and could be tightened — e.g. 'AWS Cognito has two distinct services often confused: User Pools... and Identity Pools...' and IMDSv2 narration ('Most server-side fetchers don't issue PUT requests') — placing it at 'mostly efficient but includes some unnecessary explanation' rather than the lean top anchor.	2 / 3
Actionability	Provides fully executable, copy-paste-ready CLI commands (e.g. 'aws cognito-identity get-id --identity-pool-id ... --no-sign-request', 'gcloud projects get-iam-policy') and concrete action→technique privesc tables, matching the 'fully executable code/commands' anchor.	3 / 3
Workflow Clarity	Sequenced multi-step workflows exist (Cognito Steps 1–5, AWS 'first 60 seconds' 5-step validation) with some stop-conditions ('If this returns NotAuthorizedException... stop'), but destructive/batch IAM operations lack explicit validate→fix→retry feedback loops, capping at the 'sequence present but checkpoints missing or implicit' anchor.	2 / 3
Progressive Disclosure	No bundle files exist (references/scripts/assets empty) and the ~510-line SKILL.md inlines substantial reference material (tooling table, six cited Cognito writeups, multi-cloud privesc tables) that could be split out; it is structured but closer to 'content that should be separate is inline' than the well-signaled one-level-deep top anchor.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific, naming concrete cloud-IAM attack primitives and escalation counts across AWS/Azure/GCP, and provides an explicit third-person 'Use when...' trigger with natural keyword coverage. It cleanly distinguishes its scope from neighboring hunt/supply-chain skills.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions with API primitives — 'IAM enumeration (aws iam, az role, gcloud iam)', 'STS/AssumeRole chaining', 'Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse)' — matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Clearly answers both what ('Cloud IAM red-team attack chain... privilege analysis') and when with an explicit 'Use when...' clause, hitting the top anchor; a 2 would require the when to be missing or only implied.	3 / 3
Trigger Term Quality	'Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain' covers the natural terms a user would actually say, beyond the level of 'Some relevant keywords but missing common variations'.	3 / 3
Distinctiveness Conflict Risk	Niche is clear (external cloud IAM post-credential privesc) with explicit boundary notes ('token discovery / cluster exposure is owned by hunt-k8s') making conflict with adjacent skills unlikely; not merely 'somewhat specific'.	3 / 3
	Total	12 / 12 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (522 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 2 missing	Warning

	Total	13 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/cloud-iam-deep/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.