Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/transilienceai/communitytools/cloud-defensenpx skills add transilienceai/communitytools --skill cloud-defensegit clone --depth 1 https://github.com/transilienceai/communitytoolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/transilienceai/communitytools/cloud-defense)<a href="https://agentmods.dev/skills/transilienceai/communitytools/cloud-defense"><img src="https://agentmods.dev/badge/skills/transilienceai/communitytools/cloud-defense.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.00404 |
| Opus 5 | $0.00041 | $0.00202 |
| Sonnet 5 | $0.00016 | $0.00081 |
| Haiku 4.5 | $0.00008 | $0.00040 |
Grade A, and why
cloud-defense scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Cloud Defense
The blue-team counterpart to cloud-containers. For each attacker move — lateral movement, privilege escalation, data exfiltration, defense evasion — this skill gives the log event to alert on and the single control that removes the technique. Use it to turn an offensive cloud finding into a concrete detection and remediation.
When to use
- Writing the remediation / hardening section of a cloud pentest report.
- Cloud detection engineering: deciding which control-plane events to alert on.
- Reviewing an AWS / Azure / GCP account's posture against the post-compromise chain.
Workflow
- Confirm the logging prerequisites are in place (org-wide trail, data events, threat detection on) — without them the signals below are invisible.
- Map each attacker stage to its detection signal — see reference/detection-signals.md.
- Apply the preventive control that breaks each stage — see reference/hardening-controls.md.
- Re-run the matching offensive technique from
cloud-containersto confirm the control holds or the alert fires.
References
- reference/INDEX.md — router
- reference/detection-signals.md — per-stage log signals + logging prerequisites
- reference/hardening-controls.md — the control that breaks each stage
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 28 lines · 82 tokens per session scan A 5d9ebdece9d7
cloud-defense is a skill published in the GitHub repository transilienceai/communitytools (510 stars, last pushed 1mo ago), licensed MIT. It adds 82 tokens to every session and 404 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
omv-critic
Performs adversarial pre-submission review of an Evidence.v1 finding plus optional ThreatMap.v1 and Verification.v1 sidecars. Use before /omv-report when the user wants likely CNA rejection reasons, report argument quality review, a rejectrisk rating, or a recommendation of which researchergoal (VulDB, CVE, GHSA…
sast-danger-mapper
Maps dangerous operations in a source file: memory ops, type casts, arithmetic near trust boundaries, free/dealloc patterns. Pattern matching task — list what you see, don't speculate. Use via /sast command.
sast-devils-advocate
Adversarial validator for SAST findings. Your ONLY job is to DISPROVE the candidate. Find every reason it's not exploitable. If you can't disprove it, it survives. Use via /sast command.
sast
Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast [--lang c|cpp|rust|java|python|go|php] [--min-score 4] [--max-files 30] [--skip-static] [--best-of N].
sast
Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast [--lang c|cpp|rust|java|python|go|php] [--min-score 4] [--max-files 30] [--skip-static] [--best-of N].
sast-entry-mapper
Maps entry points where untrusted data enters a source file. Lists every function that receives external input with data type, size constraints, and initial validation. Use via /sast command.