cloud-penetration-testing

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and a clear phase sequence, but it is over-long with much inline content that belongs in the reference file, and its destructive workflows lack validation checkpoints.

Suggestions

Add explicit validation/verification checkpoints after destructive or batch operations (e.g. confirm a created access key or backdoor service principal exists before proceeding, and define a verify->fix->retry loop) to raise workflow clarity.

Move the per-platform enumeration command catalogs into references/advanced-cloud-scripts.md (or per-platform reference files) and keep SKILL.md as a concise overview with one-level-deep links, improving both conciseness and progressive disclosure.

Trim redundant enumeration commands that repeat similar patterns across Azure, AWS, and GCP to reduce token overhead.

Dimension	Reasoning	Score
Conciseness	The prose is lean and assumes Claude's competence (no concept explanations), but the ~500-line body is a large command catalog with redundant per-platform enumeration that could be tightened by offloading more to the reference file.	2 / 3
Actionability	Provides extensive executable, copy-paste-ready commands (e.g. `Connect-AzAccount`, `aws sts get-caller-identity`, `az keyvault secret list`, `gcloud compute instances list`) with real flags and concrete runnable examples.	3 / 3
Workflow Clarity	The 11-phase sequence is clearly ordered, but destructive/batch operations (backdoor service principals, creating access keys, dumping secrets) lack validation or verification checkpoints and error-recovery feedback loops, capping this dimension at 2.	2 / 3
Progressive Disclosure	Sections are well organized and the single reference (references/advanced-cloud-scripts.md) is real and one level deep, but the bulk of the per-platform command catalog lives inline in SKILL.md rather than being offloaded to the reference file.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities, includes natural trigger phrases a user would say, explicitly covers both what and when, and occupies a distinct niche. No changes needed.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions such as "enumerate cloud resources", "exploit cloud misconfigurations", "extract secrets from cloud environments", and "test O365 security", matching the anchor for enumerating several specific concrete actions.	3 / 3
Completeness	Explicitly answers both what ("It provides comprehensive techniques for security assessment across major cloud platforms") and when ("This skill should be used when the user asks to..."), with explicit trigger guidance.	3 / 3
Trigger Term Quality	Quotes natural user phrases like "perform cloud penetration testing", "assess Azure or AWS or GCP security", and "audit cloud infrastructure" — good coverage of terms a user would actually say across the major platforms.	3 / 3
Distinctiveness Conflict Risk	The cloud-penetration-testing niche across Azure/AWS/GCP/O365 with distinct trigger phrases is unlikely to trigger for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (502 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: zebbern/claude-code-guide
Path: skills/cloud-penetration-testing/SKILL.md
Commit: af7d491

Reviewed: about 8 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.