How to use the Cloud Attack Methods agent skill

What is an agent skill?

An agent skill is a folder that holds a SKILL.md file. The file has a short description at the top and reference material below it. When an AI agent that supports skills sees a request that matches the description, it loads the file and uses its contents to help with the task.

This skill's SKILL.md is a dense cheat sheet rather than a tutorial. It assumes you already understand cloud security concepts and can judge the output yourself.

• Skill name: cloud-attack-methods
• Format: a single SKILL.md file
• Licence: Apache-2.0
• Language: mostly Chinese, with some English terms

What does the skill make the agent do?

The skill covers offensive techniques in several cloud areas. Its description says that when triggered, the agent uses these methods to plan and carry out attacks rather than defend against them.

The topics it lists are credential access through cloud metadata services, privilege escalation through AWS, Azure/Entra and GCP identity misconfigurations, attacks on Kubernetes clusters, testing of MinIO object storage including some listed vulnerabilities, enumeration of Alibaba Cloud Function Compute endpoints, and decryption of ChengZi SDK responses.

Install the skill from the ZIP

Download the ZIP file from the skill's page in this directory and unzip it. The folder should contain SKILL.md. You can install the skill in one of two ways.

For a personal install, place the unzipped folder in ~/.claude/skills/. To limit the skill to one project, place it in that project's .claude/skills/ folder. In the Claude apps, you can instead upload the skill under Settings, then Capabilities, then Skills.

• Personal: ~/.claude/skills/
• Single project: the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

Trigger the skill with a natural request

The agent decides whether to use a skill by matching your request against the skill's description. The description mentions cloud metadata, IAM, Kubernetes, MinIO, Aliyun FC and cloud post-exploitation, so a request that names one of these areas is most likely to load it.

Be specific about your authorisation and scope in the same message, for example that the target is a named lab range or an assessed environment under a written contract. The skill itself does not check authorisation.

• Ask about the area you are assessing, such as IAM privilege escalation in a named test account
• Name the cloud provider and service in your scenario
• State the engagement or lab context before asking for method details

What you need before you start

SKILL.md does not list any required software. The tools it mentions, including pacu, cloudfox, ScoutSuite, roadtools, GraphRunner, AADInternals, gcloud, kubectl and the aws CLI, would each need to be installed separately if you choose to run them.

The skill does not run scripts. It does use network access, so the agent's activity will reach whatever environment you point it at.

• No software is listed in SKILL.md
• Any tool the agent suggests must be installed separately
• The skill contains no scripts to run
• Network access is involved, so only target systems you are authorised to test

Safety, legal and scope notes

This is an attack playbook. Using it against systems you do not own or have written permission to test is illegal in many jurisdictions and can cause real harm. Use it only in environments you are contracted to assess, in lab ranges built for training, or within the published scope of a bug bounty programme.

The file explains attacks rather than mitigations. If you are a defender, it will not give you hardening guidance. Keep a record of your authorisation and scope, and stop when the scope ends.

• Use only on systems you own or have written permission to test
• Stay within the agreed scope and time window
• Treat the skill's output as unverified notes and check it against official documentation
• Keep logs of what you tested

Tips for getting useful results

Because the source is terse notes, the most useful results come when you already know the platform you are working on. Ask focused questions about one area at a time, and check any tool name or command the agent gives you against its official documentation before running it.

If you are new to cloud security, start with a lab range and a general cloud security course before using this skill, since the text will not teach the underlying concepts.

• Work on one provider or service per request
• Verify tool names and flags against official docs
• Start in a lab before any real engagement
• Expect Chinese-language source text; ask the agent to explain in English if needed