Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zebbern/claude-code-guide/cloud-penetration-testingnpx skills add zebbern/claude-code-guide --skill cloud-penetration-testinggit clone --depth 1 https://github.com/zebbern/claude-code-guideWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00078 | $0.03465 |
| Opus 5 | $0.00039 | $0.01733 |
| Sonnet 5 | $0.00016 | $0.00693 |
| Haiku 4.5 | $0.00008 | $0.00347 |
Grade D, and why
cloud-penetration-testing scanned grade D with 6 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variablesmediumData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
description: This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Enumerates the file system for secretsmediumData exfiltration
Searching home directories for .env, .ssh, .aws or credential files is reconnaissance for credential theft.
sudo find /home -name "credentials.db" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
unzip awscliv2.zip && sudo ./aws/install Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl https://sdk.cloud.google.com | bash Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
curl http://169.254.169.254/latest/meta-data/ Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" How it starts
The opening of the file, as written. The whole thing — 502 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloud Penetration Testing
Purpose
Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). This skill covers reconnaissance, authentication testing, resource enumeration, privilege escalation, data extraction, and persistence techniques for authorized cloud security engagements.
Prerequisites
Required Tools
# Azure tools
Install-Module -Name Az -AllowClobber -Force
Install-Module -Name MSOnline -Force
Install-Module -Name AzureAD -Force
# AWS CLI
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip && sudo ./aws/install
# GCP CLI
curl https://sdk.cloud.google.com | bash
gcloud init
# Additional tools
pip install scoutsuite pacu
Required Knowledge
- Cloud architecture fundamentals
- Identity and Access Management (IAM)
- API authentication mechanisms
- DevOps and automation concepts
Required Access
- Written authorization for testing
- Test credentials or access tokens
- Defined scope and rules of engagement
Outputs and Deliverables
- Cloud Security Assessment Report - Comprehensive findings and risk ratings
- Resource Inventory - Enumerated services, storage, and compute instances
- Credential Findings - Exposed secrets, keys, and misconfigurations
- Remediation Recommendations - Hardening guidance per platform
Core Workflow
Phase 1: Reconnaissance
Gather initial information about target cloud presence:
# Azure: Get federation info
curl "https://login.microsoftonline.com/[email protected]&xml=1"
# Azure: Get Tenant ID
curl "https://login.microsoftonline.com/target.com/v2.0/.well-known/openid-configuration"
# Enumerate cloud resources by company name
python3 cloud_enum.py -k targetcompany
# Check IP against cloud providers
cat ips.txt | python3 ip2provider.py
Phase 2: Azure Authentication
Authenticate to Azure environments:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 502 lines · 78 tokens per session scan D 73527a8c1f4d
cloud-penetration-testing is a skill published in the GitHub repository zebbern/claude-code-guide (4,597 stars, last pushed yesterday), licensed MIT. It adds 78 tokens to every session and 3,465 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it D with 6 findings (harvests environment variables, enumerates the file system for secrets, asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
aws-solution-architect
../../../engineering-team/skills/aws-solution-architect/SKILL.md.
azure-cloud-architect
../../../engineering-team/skills/azure-cloud-architect/SKILL.md.
offensive-cloud
Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, /.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcpenum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions…
cdb-scan
Map this codebase into project memory — a code graph of every symbol and how they connect, plus a written profile of stack, layout, conventions and workflows. Re-run any time to refresh both in place. Use when memory is newly installed on an existing project, or when the project has changed enough that the stored map…
mckinsey-consultant
McKinsey顾问式问题解决系统。从商业问题出发,通过假设驱动的结构化分析方法,生成McKinsey风格研究报告和PPT。融合Problem Solving方法论、MECE原则、Issue Tree拆解、Hypotheses形成、Dummy Page设计、智能数据收集和专业PPT生成能力。.
exam-coach
Quiz and coach the user for the Anthropic Claude certification exams using this repository's blueprints and official exam guides. Use when the user asks to practice, be quizzed, drill a domain, take a mock exam, or prepare for the Associate, Developer, or Architect certifications.