cloud-iam-deep

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and well-sequenced for its flagship Cognito workflow, with strong validation checkpoints for destructive operations. Its main weakness is progressive disclosure: the entire skill is one monolithic file with no reference files splitting out the large tables and writeup material.

Suggestions

Move the privesc pattern tables (AWS/Azure/GCP/K8s) and the tooling reference into separate reference files under ./references/, leaving SKILL.md as an overview with one-level-deep links.

Extract the AWS Cognito 'Disclosed cases / authoritative writeups' section into its own reference file to reduce body length and keep SKILL.md as a navigation hub.

Trim editorial prose such as 'Cloud activity is trivially auditable; the client WILL find it post-engagement' to keep the body lean.

Dimension	Reasoning	Score
Conciseness	Command-first tables and bash blocks are dense and assume competence, but the ~520-line monolith carries some trimmable prose (e.g. 'Cloud activity is trivially auditable; the client WILL find it...'), matching the score-4 anchor with minor over-explanation.	4 / 5
Actionability	Copy-paste-ready bash with real CLI flags, credential regexes, and privesc tables mapping action→technique fully cover common cases, matching the score-5 anchor.	5 / 5
Workflow Clarity	The Cognito chain is a sequenced 5-step workflow with explicit checkpoints ('If NotAuthorizedException... stop', STS verify, AccessDenied probe); general privesc is table-lookup rather than sequenced, leaving minor validation gaps relative to score-5.	4 / 5
Progressive Disclosure	No bundle files exist and the body is a single ~520-line monolith with ~18 inlined sections; content that belongs in reference files (full tooling table, all privesc patterns, Cognito writeups) is inline with no external navigation, matching the score-3 anchor.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is dense, specific, and well-bounded — it clearly states capabilities and concrete trigger contexts while distinguishing itself from neighboring skills. Its only minor weakness is trigger-term completeness, where a few natural user phrasings are not exhaustively covered.

Dimension	Reasoning	Score
Specificity	Enumerates many concrete actions — IAM enumeration, STS/AssumeRole chaining, Managed Identity abuse, IMDSv1/v2 attacks, and IAM privesc patterns (24+ AWS, 8+ Azure, 6+ GCP) — for comprehensive coverage matching the score-5 anchor.	5 / 5
Completeness	Explicitly answers both 'what' (enumeration, abuse, privesc, Cognito chain) and 'when' via a concrete 'Use when...' clause with specific triggers, matching the score-5 anchor.	5 / 5
Trigger Term Quality	Strong natural trigger coverage ('Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain'), though a few common phrasings users might say are not exhaustively present.	4 / 5
Distinctiveness Conflict Risk	Clear niche (post-credential cloud IAM privesc) with explicit 'Do NOT use for' boundaries against on-prem and hunt-* skills, giving minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (522 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 2 missing	Warning

	Total	13 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/cloud-iam-deep/SKILL.md
Commit: d4b54e1

Reviewed: 12 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.