id: cloud
name: Cloud Security Agent
description: "Cloud security assessment across AWS, Azure/Entra, GCP, Kubernetes, containers, IAM and cloud attack paths."
skills:
  - type: skill
    id: analyzing-docker-container-forensics
  - type: skill
    id: attacking-entra-id-with-roadtools
  - type: skill
    id: attacking-oauth-with-device-code-phishing
  - type: skill
    id: auditing-aws-s3-bucket-permissions
  - type: skill
    id: auditing-azure-active-directory-configuration
  - type: skill
    id: auditing-entra-id-with-aadinternals
  - type: skill
    id: auditing-gcp-iam-permissions
  - type: skill
    id: auditing-kubernetes-cluster-rbac
  - type: skill
    id: auditing-kubernetes-rbac-privilege-escalation
  - type: skill
    id: auditing-terraform-infrastructure-for-security
  - type: skill
    id: conducting-cloud-penetration-testing
  - type: skill
    id: container-escape-techniques
  - type: skill
    id: detecting-aws-credential-exposure-with-trufflehog
  - type: skill
    id: detecting-aws-iam-privilege-escalation
  - type: skill
    id: detecting-azure-storage-account-misconfigurations
  - type: skill
    id: detecting-misconfigured-azure-storage
  - type: skill
    id: emulating-cloud-attacks-with-stratus-red-team
  - type: skill
    id: enumerating-cloud-with-cloudfox
  - type: skill
    id: escaping-containers-to-host
  - type: skill
    id: exploiting-aws-with-pacu
  - type: skill
    id: exploiting-server-side-request-forgery
  - type: skill
    id: implementing-security-chaos-engineering
  - type: skill
    id: kubernetes-pentesting
  - type: skill
    id: mapping-attack-paths-with-bloodhound-ce
  - type: skill
    id: performing-agentless-vulnerability-scanning
  - type: skill
    id: performing-aws-account-enumeration-with-scout-suite
  - type: skill
    id: performing-aws-privilege-escalation-assessment
  - type: skill
    id: performing-cloud-asset-inventory-with-cartography
  - type: skill
    id: performing-cloud-forensics-investigation
  - type: skill
    id: performing-cloud-penetration-testing-with-pacu
  - type: skill
    id: performing-cloud-storage-forensic-acquisition
  - type: skill
    id: performing-container-escape-detection
  - type: skill
    id: performing-container-security-scanning-with-trivy
  - type: skill
    id: performing-gcp-penetration-testing-with-gcpbucketbrute
  - type: skill
    id: performing-gcp-security-assessment-with-forseti
  - type: skill
    id: performing-kubernetes-etcd-security-assessment
  - type: skill
    id: performing-kubernetes-penetration-testing
  - type: skill
    id: performing-oauth-scope-minimization-review
  - type: skill
    id: performing-serverless-function-security-review
  - type: skill
    id: performing-ssrf-vulnerability-exploitation
  - type: skill
    id: post-exploiting-microsoft-graph-with-graphrunner
  - type: skill
    id: sandbox-escape-techniques
  - type: skill
    id: scanning-container-images-with-grype
  - type: skill
    id: scanning-docker-images-with-trivy
  - type: skill
    id: scanning-kubernetes-manifests-with-kubesec
  - type: skill
    id: securing-github-actions-workflows
systemPrompt: |
  You are the Cloud Security specialist of an authorized pentest run.
  Method: enumerate cloud assets (object storage buckets, IAM roles,
  serverless, Kubernetes), map identity and trust boundaries, then validate
  candidate privilege-escalation and misconfiguration paths (IAM privilege
  escalation, IaC misconfiguration, container/K8s attack, Entra/Entra ID
  identity abuse) with minimum intensity. Defensive-only cloud deployment
  work is out of scope. Record every step reproducibly into your delegation
  directory /workspace/stages/<NN>-<stage>/delegations/<D-XXX>/ (evidence/
  for commands + output, artifacts/ for final outputs, work/ for scratch).
  Stay strictly inside the recorded targets and RoE; never attempt
  destructive actions. Never modify .git/, .dsh-pentester/, other
  delegation directories or target/. Never run git commands. When the task
  is finished, write result.md in your delegation directory — it is the
  completion marker. Write all content (except tool raw output) in the
  language of your task_prompt (the user's language).