Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/encod3d-sec/torch/hunt-cloudnpx skills add Encod3d-Sec/TORCH --skill hunt-cloudgit clone --depth 1 https://github.com/Encod3d-Sec/TORCHWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/encod3d-sec/torch/hunt-cloud)<a href="https://agentmods.dev/skills/encod3d-sec/torch/hunt-cloud"><img src="https://agentmods.dev/badge/skills/encod3d-sec/torch/hunt-cloud.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.01906 |
| Opus 5 | $0.00022 | $0.00953 |
| Sonnet 5 | $0.00009 | $0.00381 |
| Haiku 4.5 | $0.00004 | $0.00191 |
Grade E, and why
hunt-cloud scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
2. **Exposed keys** - `.env`, `~/.aws/credentials`, CI/CD vars, JS bundles, git history: `AKIA*`/`ASIA*` (AWS), `AccountKey=` (Azure), `"type":"service_account"` JSON (GCP). Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
1. **Metadata SSRF** - an app-side SSRF reaching `169.254.169.254` / `metadata.google.internal` hands you instance/managed-identity creds. Highest-value chain. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
FIRST**; hand-rolled `curl`/`urllib` against Graph/ARM is the drift to avoid (weaker, no paging, easy How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hunt: Cloud (AWS / Azure / GCP)
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
Wiki
qmd_query "cloud AWS Azure GCP metadata SSRF IAM privilege escalation credential discovery persistence" via wiki-search MCP
Hub: [[cloud-moc]] (live index). Primary page: [[cloud-iam-attacks]]. Payload arsenal: wiki/payloads/imds-cloud-metadata.md.
Anchors: [[aws-metadata-ssrf]] (SSRF -> IMDS creds), [[azure-ad-iam]].
Billing and safety (cloud-specific)
hunt-core owns the scope gate. Cloud stacks three specifics on top of it:
- Scope is account / subscription / project IDs, not just hostnames. Confirm the ID is in scope before the first authenticated call.
- Every call is billed and logged (CloudTrail / Azure Activity / GCP Audit Logs). Enumeration is loud, costs the client, and mass API calls trip provider abuse detection (GuardDuty / Defender). Prefer read-only enumeration, keep call volume low, and create or delete NOTHING without RoE sign-off.
- Never spray IAM users (lockout + GuardDuty). Reuse keys from
loot.mdfirst.
Attack surface (ranked)
- Metadata SSRF - an app-side SSRF reaching
169.254.169.254/metadata.google.internalhands you instance/managed-identity creds. Highest-value chain. - Exposed keys -
.env,~/.aws/credentials, CI/CD vars, JS bundles, git history:AKIA*/ASIA*(AWS),AccountKey=(Azure),"type":"service_account"JSON (GCP). - Over-privileged roles - creds in hand whose IAM grants a privesc primitive (step 4).
- Public storage - S3
*.s3.amazonaws.com, Azure*.blob.core.windows.net, GCSstorage.googleapis.com/<bucket>. Ranked last: frequently non-sensitive, easy to over-claim.
Chaining: SSRF that reaches the metadata endpoint -> pull IMDS creds; this is a hand-off from / to hunt-ssrf (that skill owns reaching the endpoint, this one owns what the creds unlock). A leaked key -> IAM enumeration -> privesc chain (step 4).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 95 lines · 43 tokens per session scan E 4579d95a8ad5
hunt-cloud is a skill published in the GitHub repository Encod3d-Sec/TORCH (286 stars, last pushed 3d ago), licensed MIT. It adds 43 tokens to every session and 1,906 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it E with 3 findings (reaches for credential files, cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gke-compute-classes
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto…
application-design-center-design-deploy
Processes GCP infrastructure design and deployment workflows within Application Design Center (ADC). Use when: - Designing GCP infrastructure with Terraform. - Validating local HCL. - Performing best-practice plan scans. - Importing templates to Application Design Center (ADC). - Deploying templates. - Troubleshooting…
gke-reliability
Improves GKE workload reliability, using PDBs, health probes, and topology spread constraints. Use when configuring GKE workload reliability, setting up PDBs, or configuring GKE health probes (liveness, readiness, startup). Don't use for disaster recovery setup or full cluster backups (use gke-backup-dr instead).
gke-workload-security
Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running cluster security audits (auditcluster.sh), configuring Workload Identity Federation (impersonation, KSA/GSA binding, and pod setup), enforcing Network Policies (default-deny…
nemo-automodel-launcher-config
Configure NeMo AutoModel job launches for interactive runs, Slurm clusters, and SkyPilot cloud execution.
azure-mgmt-botservice-dotnet
Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".