Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.
| Skill | Use for |
|---|---|
/skills/cloud/aws-iam-enum/SKILL.md | IAM enumeration + privesc |
/skills/cloud/s3-takeover/SKILL.md | Dangling bucket / subdomain takeover |
/skills/cloud/k8s-pivot/SKILL.md | Pod escape, RBAC abuse, hostPath |
/skills/cloud/terraform-state-leak/SKILL.md | Exposed state file exploitation |
/skills/cloud/imds-pivot/SKILL.md | SSRF → metadata → IAM role |
bash("aws sts get-caller-identity")bash("aws iam list-attached-user-policies --user-name <me>")iam_policy_auditbash("aws s3 cp s3://bucket/terraform.tfstate -") → tfstate_auditbash("kubectl get pods -A -o json") → k8s_auditmetadata_endpoints("aws") for the target cloudcredential node + leaks edge from the SSRF vulnplan_attack_chains(promote=True) to see the full path