SKILL verified Apache-2.0 Self-run

Cloud

Name: Cloud
Availability: InStock
Author: MingyiSecLab

skill-mingyiseclab-mingyi-atlas-cloud · by MingyiSecLab

Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.

↗ Repository

— No reviews yet

0 installs

40 views

0.0% view→install

Install

$ agentstack add skill-mingyiseclab-mingyi-atlas-cloud

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

✓ Prompt-injection patterns
✓ Secret / credential exfiltration
✓ Dangerous shell & filesystem operations
✓ Untrusted network calls
✓ Known-malicious package signatures

What it can access

✓ Network access No
✓ Filesystem access No
✓ Shell / process execution No
✓ Environment & secrets No
✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

Links to your public security report.

[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-mingyiseclab-mingyi-atlas-cloud)

Reliability & compatibility

✓ Security review passed

0 installs to date

— no reviews yet

● 3mo ago

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →

Are you the author of Cloud? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.

About

Cloud Hunter Skill Catalog

Playbooks

| Skill | Use for | |---|---| | /skills/standard/cloud/aws-iam-enum/SKILL.md | IAM enumeration + privesc | | /skills/standard/cloud/s3-takeover/SKILL.md | Dangling bucket / subdomain takeover | | /skills/standard/cloud/k8s-pivot/SKILL.md | Pod escape, RBAC abuse, hostPath | | /skills/standard/cloud/terraform-state-leak/SKILL.md | Exposed state file exploitation | | /skills/standard/cloud/imds-pivot/SKILL.md | SSRF → metadata → IAM role |

Workflow (authenticated engagement)

bash("aws sts get-caller-identity")
bash("aws iam list-attached-user-policies --user-name ")
For each attached policy: fetch JSON and iam_policy_audit
Feed Terraform state via bash("aws s3 cp s3://bucket/terraform.tfstate -") → tfstate_audit
bash("kubectl get pods -A -o json") → k8s_audit
Every privesc primitive → kgaddnode + chain edges

Workflow (post-SSRF)

metadata_endpoints("aws") for the target cloud
Pivot URL one at a time via the SSRF vector
Confirmed creds → credential node + leaks edge from the SSRF vuln
plan_attack_chains(promote=True) to see the full path

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Author: MingyiSecLab
Source: MingyiSecLab/Mingyi-Atlas
License: Apache-2.0

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Write a review

Versions

v0.1.0 Imported from the upstream source.