Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SeaOf0/dsh-redteam-model --skill cloud-playbookgit clone --depth 1 https://github.com/SeaOf0/dsh-redteam-modelWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seaof0/dsh-redteam-model/cloud-playbook)<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/cloud-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/cloud-playbook/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/cloud-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/cloud-playbook.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 59 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 59 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Server-Side Request Forgery · line 250 Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.Fix: Remove access to cloud metadata endpoints unless strictly required. If metadata is needed, restrict it (e.g. IMDSv2 with hop limit) and never expose returned credentials.
- high Server-Side Request Forgery · line 370 Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.Fix: Remove access to cloud metadata endpoints unless strictly required. If metadata is needed, restrict it (e.g. IMDSv2 with hop limit) and never expose returned credentials.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00350 | $0.10034 |
| Opus 5 | $0.00175 | $0.05017 |
| Sonnet 5 | $0.00070 | $0.02007 |
| Haiku 4.5 | $0.00035 | $0.01003 |
Grade A, and why
cloud-playbook scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 381 lines — stays where its author put it; the contents beside it link to each section on GitHub.
云安全攻防作战手册
主观念=攻击路径主线；七门 C1-C7；成果页=云攻击路径板式（第五板式）。
开工顺序：工作区发现 → WORKSPACE.md → tool-plane 检测登记 → 优先看 route-boost 信封 （已含门禁与 canonical 名），信封缺失/不确定再调 gates_list（mode=cloud-security）。
覆盖度台账（operation-state 扩展，与门禁同源）：
operation_goal登记目标契约后先operation_constraints登记用户约束（deny/allow 每行一条，带匹配词的 deny 命中 bash/fetch 即确定性拦；约束每轮进信封防压缩丢失）再operation_scope登记范围分母——每行一项（资产/路由/模块/账号/题目等目标实际要求覆盖的单元；「id: 标签」可固定 id；最小范围原则：只登记目标明确点到或派生必需的面，绝不擅自放大）；每测完一项即operation_progress tested=<id> evidence=<evidence 编号/矩阵行/输出文件>记分子（幂等，重复标记刷新证据）。scope 登记后本模式报告门自动开启算术对账：报告须含「覆盖：M/N」声明行且与台账实测一致——部分覆盖照实声明可过，虚报/漏报拦门。开新方向（派单/追线/阶段切换）先operation_intent登记带锚（anchor=boot 开局豁免 / criterion 准则 / scope 范围 / finding 本会话成果 / chain 链路节点 + id）——方向只能锚在已确立的证据上；收口operation_progress intent_done/intent_blocked/intent_dropped（blocked/dropped 附原因）；未收口意图拦报告落盘。
定位与设计依据
云安全攻防模式（cloud-security）覆盖：云平台（AWS/Azure/GCP/阿里云/腾讯云/华为云）与 云原生（K8s/容器/Serverless/CI-CD）渗透测试——云资产暴露面测绘、AK/SK 与凭证泄露利用、 IAM 权限提升、对象存储/云数据库配置缺陷、元数据 SSRF、容器逃逸与集群提权、云检测对抗与 检测缺口评估。攻击视角默认授权（统一授权立场）；web 入口协同 pentest、IaC/云源码审计协同 code-audit、检测侧移交 attack-defense/av-evasion；云侧发现失陷迹象（异常登录/后门资源/ 恶意镜像）→ 就地加载 IR playbook 云上主机场景知识或走流转表。
攻击路径主线（主观念）
- 每条云上攻击路径由「身份→权限→资源→影响」四要素闭环支撑；配置缺陷必须给出可到达性 证明（谁能到 / 怎么到 / 拿到什么）。
- 发现 ≠ 真实；真实 = API 响应原文 + 策略文档 + 权限清单三重证据。
- 验证纪律：只读 API 优先（Describe/Get/List）、破坏性操作先询问、速率与账单意识。
- 证据三档 confirmed / partial / unknown；无证据标「疑似」，疑似不进报告。
云上战果扩大作战流程（攻击引擎主线战法）
定位：七阶段与七门=合规审计底座与收口纪律；本章=攻击引擎——以扩大攻击战果为主线 的作战时序，战果穷尽时正好承接 C4 权限链收口与 C5 检测缺口评估。 云上战果的本质：地盘不是网络，是身份与信任关系——两个引擎驱动扩大： ① 凭证循环：几乎每个战果都产出新凭证（桶里配置含 key、secret 里存着别账号 token、 角色可以被扮演）——拿下任何东西先问「这里面还有什么凭证」； ② 信任链枚举：谁能扮演谁（AssumeRole 信任/服务绑定/OIDC 联邦/跨账号委托）—— 信任边即横向边。 战果五类：身份权限（凭证/角色/管理员/组织根）、控制面（控制台/K8s API/CI 平台）、 数据（桶/库/快照/Secrets）、持久化（后门角色/新增 key/镜像投毒）、横向立足（跨账号/ 跨服务/跨云）。
高价值目标对照（发现即提级）
| 云上目标 | 战法直觉对应 | 理由 |
|---|---|---|
| KMS / 密钥管理 | 域控级 | 加密权=解密所有用它的桶/RDS/参数，一个权限通吃 |
| IdP / OIDC 联邦信任 | 堡垒机级 | 接管身份源=接管一切经 SSO 登录的目标账号 |
| 组织根 / 管理账号 | 域控 2.0 | Organizations/资源目录管理账号可进一切成员账号 |
| iam:CreateAccessKey / CreateRole 类权限 | 「能造账号的权限」 | 能造身份=战果无限再生 |
| CI/CD 平台 | DevOps 高价值线 | 流水线凭据直通批量工作负载 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +3 lines 26d911b41e40
- 9d ago First seen · 378 lines · 350 tokens per session scan E 64a47d86ccb2
cloud-playbook is a skill published in the GitHub repository SeaOf0/dsh-redteam-model (325 stars, last pushed 5d ago), licensed MIT. It adds 350 tokens to every session and 10,034 once invoked, about $0.0018 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
kubernetes-patterns
Kubernetes workload patterns, resource management, RBAC, probes, autoscaling, ConfigMap/Secret handling, and kubectl debugging for production-grade deployments. Use when writing or reviewing Kubernetes manifests, or debugging probes, RBAC, autoscaling, or resource limits.
azd-deployment
Deploy containerized frontend + backend applications to Azure Container Apps with remote builds, managed identity, and idempotent infrastructure.
openshell-cli
Guide agents through using the OpenShell CLI (openshell) for sandbox management, gateway registration, provider configuration and refresh, policy iteration, settings, service exposure, BYOC workflows, and inference routing. Covers basic through advanced multi-step workflows. Trigger keywords - openshell, sandbox…
langbot-deploy
Deploy and configure a LangBot instance — Docker / Docker Compose, Kubernetes, the config.yaml model, the Box sandbox runtime, the plugin runtime, and the global API key. Use when installing, deploying, upgrading, or configuring LangBot in production or self-hosted environments. Triggers on "deploy langbot", "langbot…
compute-env-setup
Set up a compute environment on a remote provider so Claude Science jobs can run there. Covers direct SSH/conda hosts, Slurm clusters, container-via-bridge runners, and managed-API providers (Modal, GCP, RunPod). Use when standing up a new provider, porting an env to a different backend, adding a tool that needs its…
azure-cloud-migrate
Assess and migrate cross-cloud workloads to Azure with reports and code conversion. Supports Lambda→Functions, Beanstalk/Heroku/App Engine→App Service, Fargate/Kubernetes/Cloud Run/Spring Boot→Container Apps. WHEN: migrate Lambda to Functions, AWS to Azure, migrate Beanstalk, migrate Heroku, migrate App Engine, Cloud…