Skip to content
Get packs

Offensive Cloud Security Methodology

Guides an agent through AWS, Azure and GCP attack-path testing, from credential theft to privilege escalation.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a structured playbook for attacking cloud accounts in authorized security tests: discovering who the agent is inside AWS, Azure or GCP, finding privilege-escalation paths, locating data and persistence options, and documenting the attack chain. Once installed, the agent knows the specific commands and tools (such as Pacu, ScoutSuite, Prowler and ROADtools) and the known IAM misconfigurations to look for. It is written as offensive tradecraft, not defensive hardening guidance.

Great for

  • Penetration testers with written scope covering cloud accounts
  • Red team members practicing cloud attack paths in a lab
  • Security engineers who want to understand how attackers chain IAM permissions

Skip it if

  • Anyone without written authorization: the content describes credential theft, persistence and detection evasion, which is illegal against systems you do not own or have permission to test.
  • Production environments without a change-control plan: some steps (snapshot sharing, IAM key creation, logging changes) alter real resources and can cause data exposure or outages.
  • Beginners looking for cloud hardening advice: the skill focuses on attacking, not defending, so it will not tell you how to secure an account.

Try asking

  • “Enumerate what permissions the AWS credentials I found in this lab account grant and list possible privilege-escalation paths.”
  • “Map the Azure AD roles in our authorized test tenant to known escalation primitives and summarize them for the report.”
  • “Walk through the IMDS credential-theft steps against our test EC2 instance and record timestamps for the kill chain.”
  • “Check which GCP service account permissions could allow token creation in our scoped project.”
Step-by-step guide: how to use Offensive Cloud Security MethodologyInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-cloud.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-cloud.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-cloud.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it with signed scope documents and test accounts; state the engagement scope in your prompt so the agent stays within it.
  • Ask the agent to start with read-only enumeration (identity and permission checks) before any write actions.
  • Review every command the agent proposes before running it, since the skill's examples include commands that modify snapshots, policies and logging.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.