Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Miosa-osa/OSA --skill offensive-cloudgit clone --depth 1 https://github.com/Miosa-osa/OSAWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/miosa-osa/osa/offensive-cloud)<a href="https://agentmods.dev/skills/miosa-osa/osa/offensive-cloud"><img src="https://agentmods.dev/badge/skills/miosa-osa/osa/offensive-cloud/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/miosa-osa/osa/offensive-cloud"><img src="https://agentmods.dev/badge/skills/miosa-osa/osa/offensive-cloud.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00230 | $0.03435 |
| Opus 5.5 | $0.00092 | $0.01374 |
| Sonnet 5.5 | $0.00046 | $0.00687 |
| Haiku 4.5 | $0.00023 | $0.00344 |
Grade B, and why
offensive-cloud scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> This is a copy
92% identical to offensive-cloud — 42 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 387 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloud (AWS / Azure / GCP) — Offensive Testing Methodology
Quick Workflow
- Identify the cloud and the identity context you have (user, role, service account, instance role)
- Enumerate without writes —
aws sts get-caller-identity,az account show,gcloud auth list - Map permissions to known privilege-escalation primitives (PassRole, Owner, etc.)
- Find the data and the persistence anchors before alarms fire
- Document the kill chain with timestamps, identities, and resources for the report
AWS
Identity Discovery
aws sts get-caller-identity
aws iam list-attached-user-policies --user-name $(aws sts get-caller-identity --query Arn --output text | awk -F/ '{print $NF}')
aws iam list-attached-role-policies --role-name <role>
aws iam simulate-principal-policy --policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \
--action-names "*"
IMDS Credential Theft
# IMDSv1 (legacy)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>
# IMDSv2 (modern, requires token)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
-H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" \
http://169.254.169.254/latest/meta-data/iam/security-credentials/
From SSRF, IMDSv2 was historically reachable when the SSRF allowed setting custom headers. Modern AWS denies SSRF without Host: 169.254.169.254 and proper PUT-then-GET flow — SSRF in 2024+ rarely yields IMDSv2 unless the proxy reflects custom headers.
Privilege Escalation Paths
| Path | Required Permission | Outcome |
|---|---|---|
iam:PassRole + lambda:CreateFunction |
Pass any role to Lambda you create | Run code as that role |
iam:PassRole + ec2:RunInstances |
Pass any role to EC2 instance | IMDS → role creds |
iam:CreatePolicyVersion + iam:SetDefaultPolicyVersion |
Edit your own policy | Self-elevate |
iam:UpdateAssumeRolePolicy |
On a privileged role | Add yourself as principal |
iam:CreateLoginProfile (on user without one) |
Set console password | Console access |
iam:CreateAccessKey (on another user) |
Mint keys for someone else | Persistent access |
sts:AssumeRole with sts:TagSession to ABAC role |
If role trusts session tags | Tag-based escalation |
cloudformation:CreateStack + permissive role |
Run any service action | Indirect arbitrary perms |
glue:UpdateDevEndpoint |
Inject SSH key into Glue endpoint | Code exec as Glue role |
ssm:SendCommand to any instance |
RCE on instances + their roles | Lateral + escalation |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 387 lines · 230 tokens per session scan B 0c8ddeefad47
offensive-cloud is a skill published in the GitHub repository Miosa-osa/OSA (78 stars, last pushed 9d ago), licensed Apache-2.0. It adds 230 tokens to every session and 3,435 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it B with 2 findings (cloud metadata endpoint, makes network calls). It is 92% identical to offensive-cloud, differing in 42 lines, and is treated as a copy.
Other skills, from other repositories
cloudflare-temporary-deploy
Deploy a Worker live, no account, via wrangler --temporary.
tensorrt-llm
High-throughput LLM inference on NVIDIA GPUs.
latchbio-integration
Latch platform for bioinformatics workflows. Build pipelines with Latch SDK, @workflow/@task decorators, deploy serverless workflows, LatchFile/LatchDir, Nextflow/Snakemake integration.
remote-compute-modal
Run GPU jobs on the user's own Modal account via host.compute.create('byoc:modal', ...). Covers the create→submit→waitfornotification flow, the computeprovider kernel for env setup, image/volume resolution, and the two approval cards. Load once you've decided to dispatch to Modal.
lambda-labs
On-demand GPU cloud instances for ML training.
here-now
Publish sites to {slug}.here.now and store files in Drives.