The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands for cloud reconnaissance and exploitation. These include the use of curl for targeted dorking of S3 buckets and Firebase endpoints, aws cli for credential extraction, and docker for running infrastructure simulations.
[DATA_EXFILTRATION]: The skill documents techniques for "covert exfil" by weaponizing AWS CloudWatch RUM telemetry. It provides specific aws rum put-rum-events commands designed to embed exfiltrated data within custom telemetry payloads to bypass Data Loss Prevention (DLP) and SIEM monitoring.
[CREDENTIALS_UNSAFE]: Detailed instructions are provided for harvesting AWS credentials. This includes extracting identityPoolId and guestRoleArn from JavaScript bundles to obtain STS tokens via Cognito, as well as accessing sensitive file paths like /.env and /config.json on exposed admin panels.
[PRIVILEGE_ESCALATION]: The skill guides the user through identifying and exploiting over-permissioned IAM roles. It specifically highlights the Cognito Identity Pool chain to escalate from unauthenticated web access to broader AWS service permissions such as s3:* or iam:PassRole.
[REMOTE_CODE_EXECUTION]: The documentation discusses attack vectors for achieving code execution, such as script source poisoning of self-hosted RUM snippets (cwr.js) and supply-chain attacks targeting package registries.
[INDIRECT_PROMPT_INJECTION]: The skill describes a vulnerability surface where malicious payloads (such as XSS) can be injected into telemetry data. These payloads are designed to execute when viewed by an analyst in a monitoring dashboard, representing a multi-step injection chain.

hunt-cloud-misconfig