Guide · Agent skill
How to use the Cloud Decoy Deployment agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This is an agent skill, a packaged set of instructions and helper files that an AI agent such as Claude loads when your request matches its purpose. The skill for deploying cloud deception guides the agent through planting decoy resources in AWS, Azure and GCP (fake access keys, unused user accounts, empty storage buckets and fake secrets) and wiring alerts so any touch on them reaches your security team. After this guide you will know what the skill does, how to install it, how to phrase a request that triggers it, and what you must have in place before running any of its commands.
Cloud Decoy Deploymentmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or .claude/skills/ inside a project. Alternatively, upload it in the Claude apps under Settings → Capabilities → Skills.
- 2Confirm audit logging is on. Enable CloudTrail with data events, Azure Activity and Entra logs, or GCP Cloud Audit Logs before planting any decoy. Alerts depend on these logs.
- 3Set up an alert destination. Create an SNS topic, a Microsoft Sentinel workspace or a GCP Pub/Sub topic that will receive decoy alerts and route them to your SOC.
- 4Ask the agent for a specific decoy. Describe the decoy you want, the cloud and the account in plain language, such as a canary AWS access key on a permission-less user.
- 5Review and adapt the commands. Check every command the agent proposes, replacing example names and account IDs. Remember that running them creates real resources and costs.
- 6Plant the decoys with deny-all controls. Create decoy principals with no real permissions and label them internally, keeping labels out of attacker-visible metadata.
- 7Validate and record. Have an authorized tester use each decoy, confirm the alert arrives in time, and record the result in your deployment inventory.
What does this skill make the agent do?
The skill covers decoy (honey) resources across AWS, Azure and GCP. A decoy is a cloud object that exists only to be touched by an attacker, so the skill's core idea is that any use of one is a strong signal of malicious or unauthorized activity. The source names canary IAM access keys, permission-less decoy users, roles or service principals, honey object-storage buckets, and decoy secrets in Secrets Manager, Key Vault or Secret Manager.
The agent works through a sequence: decide what to mimic, plant the decoys, route their alerts through CloudTrail and EventBridge (AWS), Microsoft Sentinel and Defender (Azure), or Cloud Audit Logs and Cloud Monitoring (GCP), validate that an alert actually arrives, and keep the decoys realistic over time.
- Canary access keys on a decoy user with an explicit deny-all policy
- Honey S3 buckets with alerts on reads and listings
- Decoy secrets whose retrieval triggers an alert
- Decoy GCP service accounts with no role bindings
- A Python script (scripts/process.py) that checks a decoy inventory for required safety controls and produces a deployment record
Install the skill from the ZIP file
Download the ZIP for this skill from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder instead.
If you use the Claude apps, you can upload the skill instead of copying files. Open Settings, go to Capabilities, then Skills, and upload the skill there.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
Check what you need before you trigger it
The skill assumes a working cloud environment. The source lists the tooling it expects: the AWS CLI, Azure tooling and/or gcloud and gsutil, with credentials that have IAM and storage admin rights. Python 3 is needed to run scripts/process.py. You also need an alert destination such as an SNS topic, a Microsoft Sentinel workspace or a GCP Pub/Sub topic.
Audit logging must already be enabled. This is not optional, because the alerts depend on it. The source specifies AWS CloudTrail (multi-region, with management and relevant data events), Azure Activity and Microsoft Entra logs, and GCP Cloud Audit Logs. If these are off, a decoy touch will not produce an alert.
- AWS CLI, Azure tooling and/or gcloud and gsutil
- Credentials with IAM and storage admin rights
- Python 3
- Audit logging enabled: CloudTrail, Azure Activity/Entra logs, or GCP Cloud Audit Logs
- An alert destination: SNS topic, Microsoft Sentinel workspace, or GCP Pub/Sub
Trigger the skill with a natural request
You do not need special syntax. Describe the outcome you want in plain language and name the cloud. The skill is meant for cases such as protecting cloud accounts that hold important data, seeding fake AWS keys to catch credential theft, or detecting reconnaissance inside a cloud account.
Give the agent your account context, such as the cloud, the account or project name, and where your attackers are likely to look for credentials. The agent will still need you to review and adapt every command before running it.
- Set up a canary AWS access key on a permission-less user and alert the SOC when it is used.
- Create a honey S3 bucket in our AWS account that alerts on any GetObject or ListBucket call.
- Plan decoy credentials for our CI variables and internal wiki in Azure, wired to Microsoft Sentinel.
- Add a decoy GCP service account with no roles and an alerting policy in Cloud Monitoring.
Review and run the commands safely
The commands in the skill are examples. Review each one and adapt names, regions and account IDs to your environment before running it. Running them creates real cloud resources and costs money, so treat each step as a change to production infrastructure.
Decoy principals must have no real permissions. The skill uses an explicit deny-all policy for AWS decoy users. Label decoys internally, for example with a deception=true tag, and keep that label out of attacker-visible metadata. Otherwise automated tools or staff may mistake a decoy for a live credential.
- Read every command before running it and replace example names such as svc-backup-prod with names that fit your account.
- Never give a decoy any real privilege.
- Track each decoy in an inventory so it is never cleaned up or mistaken for a real asset.
- Note that the skill's script and network use are part of its design, so run it in an account where you are authorized to make changes.
aws iam create-user --user-name svc-backup-prod --tags Key=deception,Value=trueValidate that alerts actually fire
An untested decoy is assumed to be broken. The skill's validation step asks an authorized tester to use each decoy, for example by reading the bucket, calling with the key or fetching the secret, and then confirming that an alert arrives end to end within your target latency.
The deployment record template in assets/template.md is a worked example of a decoy inventory. It records each decoy, its cloud, its type, where it is placed, the detection path and playbook, whether it is deny-all, and the target latency.
- Use an authorized tester, not an attacker simulation run by someone without permission.
- Record the result of each test in the deployment record.
- Re-test after you change alert routing.
What people use it for
- A cloud security engineer plants a canary access key in CI variables and a repo .env file, then gets an alert the moment it is used.
- A team with only on-prem honeypots adds a honey S3 bucket named to look like a database backup store, with alerts on reads and listings.
- A blue team writes an incident response playbook that treats any decoy hit as a high-fidelity signal and routes it straight to incident response.
- A security team plants a decoy secret such as a fake database master password in Secrets Manager and alerts on retrieval.
Frequently asked questions
How do I install the cloud decoy deployment agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
What do I need before using this skill?
You need the AWS CLI, Azure tooling and/or gcloud and gsutil, credentials with IAM and storage admin rights, and Python 3. Cloud audit logging must already be enabled, and you need an alert destination such as an SNS topic, a Microsoft Sentinel workspace or a GCP Pub/Sub topic.
Is this skill free to use?
The skill is licensed under Apache-2.0, as stated on this page. The cloud resources the commands create are not free, because they run in your own AWS, Azure or GCP accounts and incur normal charges.
Why do alerts not fire after I deploy a decoy?
The most likely cause is that audit logging is not enabled or not routed to your alert destination. The skill depends on CloudTrail, Azure Activity and Entra logs, or GCP Cloud Audit Logs. Confirm these are on, then test the decoy with an authorized tester.
Can I use a decoy that has real permissions?
The skill says no. Decoy principals must be permission-less, using an explicit deny-all policy. The value of the decoy is the alert, not access, so a decoy with real privilege is a liability.
What are the alternatives to this skill?
The source points to on-prem honeypot, honeytoken and canary-token skills for on-premises deception, and to designing-adversary-engagement-with-mitre-engage for program strategy. It does not name commercial cloud deception products, so compare those yourself if you need a turnkey tool.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits cloud security engineers and blue teams who already run audit logging on AWS, Azure or GCP and want tripwires that produce high-fidelity alerts. It is not a turnkey product, because you must review and adapt every command, and it creates real resources and costs. Teams without audit logging, or those that cannot keep decoy credentials clearly labelled, should fix those gaps first or choose a different approach.
Download the skill