How to use the Cloud Storage Access Pattern Analyzer skill

What the skill makes the agent do

The skill targets abnormal access to cloud storage. It describes analysing CloudTrail Data Events, GCS audit logs and Azure Storage Analytics for three main patterns: after-hours bulk downloads, access from IP addresses not seen before, and API-call spikes such as GetObject or object-listing requests.

The skill works from statistical baselines and time-series anomaly detection. The procedure is to query CloudTrail for S3 data events, build baselines of hourly request volume, per-user object counts and source IP history, run the anomaly checks, and produce a prioritised findings report. The findings are meant to help analysts decide what to investigate first. The skill analyses past events and does not block or stop access.

Install the skill in Claude

Download the ZIP file for the skill from this page. Then install it in one of two ways. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project. Alternatively, upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.

Once installed, the agent can find the skill when your request matches its description. You do not need to type a special command.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ in your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Set up the requirements

The skill needs Python 3.8 or newer, the boto3 and requests Python packages, and the AWS CLI installed and configured with credentials that can read CloudTrail. You also need access to CloudTrail data events for the bucket you are checking. Without those logs, the skill has nothing to analyse.

The skill's instructions list this install command for the Python packages:

Ask for the analysis in plain language

You do not need exact syntax to trigger the skill. Describe the bucket and the concern. Requests that mention suspected data exfiltration, unusual downloads, access from unfamiliar IP addresses, or building detection rules for S3, GCS or Azure Blob should match the skill's description.

The skill also includes a bundled Python script, scripts/agent.py, which pulls recent AWS CloudTrail events for a bucket and writes a JSON report. The example in the skill runs it against a bucket for the last 24 hours and saves the output to a file. Replace the bucket name with your own:

• Review access to my-sensitive-data over the last 24 hours and flag large downloads outside business hours.
• Check whether any IP addresses accessed our finance bucket this week that we have not seen before.
• Help me write detection rules for GetObject spikes in our Azure Blob storage account.

Understand the detection rules and limits

The skill uses fixed rules of thumb. After-hours access means activity outside 8am to 6pm local time. A bulk download is more than 100 GetObject calls from a single principal in one hour. A new source IP is one not seen in the prior 30 days. ListBucket enumeration spikes are flagged as a possible reconnaissance sign.

The bundled script is an excerpt. The source does not show its GCS or Azure logic, so treat findings for those platforms as something to verify by hand. The thresholds are not tuned to your environment, so expect false positives and false negatives.

• After-hours: outside 8am-6pm local time
• Bulk download: more than 100 GetObject calls from one principal in 1 hour
• New IP: not seen in the prior 30 days
• Listing spike: unusual ListBucket activity, a reconnaissance indicator

Safety notes before you run it

The skill reads sensitive access records, so only use it on logs you are authorised to review. The skill runs scripts and uses the network, because the script calls AWS to fetch CloudTrail events. Read scripts/agent.py before running it in an environment that holds production credentials, and run it against a test or lab environment first, as the skill's prerequisites recommend.

Treat the output as a prioritisation aid. A flagged event may be a legitimate backup, deployment or analyst action, so confirm each finding against the actual event details and the principal's expected role.

• Use only with logs you are authorised to review
• The script makes network calls to AWS
• Test in a lab environment first
• Verify every finding before acting on it