CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-cloud-misconfig

Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).

68

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete executable commands and a solid validation checklist, but it leans verbose in the RUM section and presents everything inline rather than splitting deep material into referenced bundle files. Routing a trimmed overview toward separate reference files and tightening the narrative prose would lift the lower dimensions.

Suggestions

Move the full RUM writeup (detection fingerprints, attack chains A-D, severity rubric, and external writeup list) into a references/ file (e.g. references/rum-weaponization.md) and keep SKILL.md as a concise overview that links to it one level deep.

Trim background prose Claude already knows (e.g. the service launch history and defender-visibility narrative) so every remaining token earns its place.

Add a single sequenced top-level hunt workflow (detect -> extract -> validate) with explicit checkpoints, reusing the existing validation checklist as the closing gate, to raise workflow clarity.

DimensionReasoningScore

Conciseness

Mostly efficient and actionable, but the RUM section includes background prose Claude already knows ('launched late 2021... sends performance/error events') and narrative explanation of defender visibility that could be trimmed. Not level 3 because not every token earns its place; not level 1 because it is not padded with basic concepts throughout.

2 / 3

Actionability

Provides fully executable, copy-paste-ready commands throughout: 'aws s3 ls s3://target-bucket-name --no-sign-request', exact 'aws cognito-identity get-id' chains, grep regex sets, and a complete 'aws rum put-rum-events' invocation. Not level 2 because nothing is pseudocode or incomplete.

3 / 3

Workflow Clarity

Has a strong numbered 'Validation checklist (before reporting)' with an explicit gate (step 5: 'Without this, the finding is Informational'; step 7 read-only constraint), but the overall hunt flow (detect -> extract -> validate) is spread across sections rather than one sequenced workflow with checkpoints. Not level 3 because there is no single clear end-to-end ordered process with feedback loops; not level 1 because validation and sequencing clearly exist for the key chain.

2 / 3

Progressive Disclosure

No bundle files exist (references/scripts/assets absent) and the body is a monolithic document with the full RUM deep-dive, severity rubric, and external writeup list inlined rather than split into referenced files; only headings and cross-links to other skills provide organization. Not level 3 because content that should be separate is inline with no one-level-deep reference structure; not level 1 because headings prevent it from being an undifferentiated wall of text.

2 / 3

Total

9

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, provider-comprehensive, and carries an explicit 'Use when' trigger plus clear disambiguation from adjacent skills, all in third-person voice. It is a strong, routing-ready description with no significant weaknesses.

DimensionReasoningScore

Specificity

Lists many concrete actions across AWS/GCP/Azure (e.g. 'public S3 buckets (s3:GetObject anonymous)', 'IAM credentials in JS bundles', 'AWS metadata accessible via SSRF') plus detection and validation methods, matching the comprehensive multi-action anchor.

3 / 3

Completeness

Explicitly answers both what ('Hunt cloud / infrastructure misconfigurations') and when ('Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services)'), satisfying the explicit-trigger anchor.

3 / 3

Trigger Term Quality

Natural hunter vocabulary is well covered ('S3 buckets', 'cloud misconfig', 'SSRF', 'public RDS snapshot', 'leaked service account JSON'), with common variations across the three cloud providers rather than jargon-only phrasing.

3 / 3

Distinctiveness Conflict Risk

A clear cloud-misconfig niche with explicit disambiguation from siblings ('Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep'), making wrong-skill triggering unlikely.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 2 missing

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.