Skip to content
TrustedSkillsbeta
Back to all skills

Cloud Penetration Testing

Listed
sickn33·vlatest·cloud·MIT

Simulates cloud environment attacks to identify vulnerabilities in configurations, access controls, and deployed services.

Repository

Install on your platform

Showing Claude Code. One command installs this skill into any of the agents below.

  1. 1

    Run this in your project

    terminal
    $ npx skills add sickn33/agentic-awesome-skills --skill cloud-penetration-testing -a claude-code

  2. Uses the open-source skills CLI and needs Node.js. Add -g to install it for your user instead of this project.

What we know about this skill

Publisher

sickn33

Taken from the source listing. We haven't verified who controls this account.

Install target

Live repository

Not pinned. Installing fetches whatever the repository holds at the time you run the command.

No human has reviewed this code. The checks below are a static scan of the files at one commit — nobody has run this skill or judged whether it works. A skill runs with whatever access you give your agent, so read the source before you install it.

Automated safety checks

scanned

This skill failed 1 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.

  • Declares what it does: failed

    No SKILL.md was found in the skill's directory.

    SKILL.md exists, its frontmatter parses, and it declares a name and a description.

  • No undeclared network calls: passed

    Makes no network calls.

    Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.

  • No obfuscated payloads: passed

    No encoded or obfuscated payloads.

    No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.

  • No credential access: passed

    Reads no keys, tokens, keychains or credential files.

    Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.

  • No pipe-to-shell installers: passed

    No pipe-to-shell or download-and-run installers.

    No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.

  • Pinned to a commit: passed

    Scanned sickn33/antigravity-awesome-skills at 5a4cdd9df8.

    The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit
5a4cdd9df8
Manifest
skills/cloud-penetration-testing/SKILL.md
Scanned
0 files
Copies in repo
3 — all of them scanned
This is a static scan, not a review. It reads the skill's files; it does not run them, and it cannot tell you whether the skill is any good or whether the code does what its description says. A skill runs with whatever access you give your agent.
What each check looks for →

About this skill

What it does

This skill simulates cloud environment attacks to identify vulnerabilities in configurations, access controls, and deployed services across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It covers a range of techniques including reconnaissance, authentication testing, resource enumeration, privilege escalation, data extraction, and persistence. The output includes comprehensive findings, risk ratings, inventory of resources, credential findings, and remediation recommendations. Authorized use only - this skill is intended for authorized security assessments, defensive validation, or controlled educational environments.

When to use it

  • Conducting a security assessment of an Azure environment.
  • Evaluating the effectiveness of IAM controls in an AWS deployment.
  • Identifying misconfigurations and vulnerabilities within a GCP infrastructure.
  • Validating the security posture of cloud-based services.
  • Performing controlled educational exercises on cloud penetration testing techniques.

Key capabilities

  • Cloud Platform Support: Assesses Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
  • Reconnaissance: Gathers information about a target's cloud presence using tools like curl and custom Python scripts (cloud_enum.py, ip2provider.py).
  • Authentication Testing: Supports authentication via Az PowerShell module, MSOnline module, stolen context import, and credential-based login (potentially bypassing MFA).
  • Resource Enumeration: Lists Azure contexts, subscriptions, role assignments, resources, resource groups, storage accounts, web applications, SQL servers, and databases.
  • Reporting: Generates a Cloud Security Assessment Report with findings, risk ratings, a resource inventory, credential findings, and remediation recommendations.

Example prompts

  • "Simulate reconnaissance on targetcompany to identify their cloud resources."
  • "Authenticate to Azure using the provided credentials and enumerate all web applications."
  • “Import this stolen token profile: C:\Temp\StolenToken.json and list available contexts.”

Tips & gotchas

  • Prerequisites: This skill requires specific tools (Az PowerShell module, AWS CLI, GCP CLI, scoutsuite, pacu) to be installed and configured beforehand. Refer to the "Required Tools" section for installation instructions.
  • Authorization Required: Use of this skill requires written authorization for testing and defined rules of engagement. Unauthorized use is strictly prohibited.
  • Knowledge Base: A foundational understanding of cloud architecture, IAM, API authentication, and DevOps concepts is necessary to effectively utilize the skill’s output.