The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides numerous commands to extract sensitive credentials and tokens from cloud infrastructure.
Extraction of IAM security credentials from the AWS Instance Metadata Service (IMDS) via curl http://169.254.169.254/latest/meta-data/iam/security-credentials/.
Retrieval of Azure AD OAuth2 tokens from the local metadata identity endpoint.
Extraction of Google Cloud service account tokens from the GCP metadata server.
Commands to harvest secrets from AWS Secrets Manager (get-secret-value), SSM Parameter Store (get-parameters-by-path), and Azure Key Vault (keyvault secret show).
Extraction of Kubernetes service account tokens from the filesystem at /var/run/secrets/kubernetes.io/serviceaccount/token.
[DATA_EXFILTRATION]: The skill includes instructions for enumerating and accessing private data stored in cloud buckets.
Recursive listing of S3 buckets and retrieval of bucket policies/ACLs.
Copying files from GCP storage buckets to the local environment using gsutil cp.
Commands to search for and access RDS snapshots.
[COMMAND_EXECUTION]: The skill provides detailed paths for privilege escalation and system compromise through shell command execution.
Privilege escalation in AWS via IAM policy manipulation, role passing, and Lambda code injection.
Container escapes using the nsenter command to enter the host namespace from a privileged pod.
Abuse of the Docker socket (/var/run/docker.sock) to mount the host filesystem and gain host access.
Utilization of offensive security tools including pacu for AWS exploitation and peirates for Kubernetes penetration testing.
Defense evasion through the command aws cloudtrail stop-logging, which disables auditing and logging of malicious activities.

cloud-security