Hi - I answer from the OpenSmartRoute documentation: routing, the API, plans and quotas, self-hosting. Ask away, or open a support ticket if you need a person.
Grounded in the docs - follow a source before acting on it.
cloud-iam-deep - Skill - OpenSmartRoute
Skillv1.0.0
cloud-iam-deep
Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam),
Imported from elementalsouls/Claude-BugHunter (skills/cloud-iam-deep/SKILL.md). Install upstream with npx skills add elementalsouls/Claude-BugHunter --skill cloud-iam-deep. Copyright stays with the author.
When to use
Trigger when:
A cloud credential surfaces (key, secret, token, JSON file)
SSRF chain reaches IMDS / metadata endpoint
APK / git-leak reveals embedded cloud key
Recon shows public S3/GCS/Azure-blob with permissions you can verify
A Kubernetes API or service-account token is exposed
Post-RCE on a cloud-hosted instance — pivot to cloud control plane
Do NOT use for:
On-prem-only environments (use AD attack skills — but those are out of scope per external-only boundary)
Web2 vulns that happen to be on AWS — use the relevant hunt-* skill
Credential identification (first 60 seconds)
# AWS access key patternsAKIA[0-9A-Z]{16} # IAM user access key (long-term)ASIA[0-9A-Z]{16} # STS temporary credentialAGPA[0-9A-Z]{16} # IAM groupAIDA[0-9A-Z]{16} # IAM user (user-id)AROA[0-9A-Z]{16} # IAM roleANPA[0-9A-Z]{16} # Managed policy# AWS secret pattern (40-char base64-ish — context required)[A-Za-z0-9/+=]{40} # AWS secret access key# AzureAccountKey=[A-Za-z0-9+/=]{86} # Storage account keyclient_secret pattern + UUID # Azure AD app credential# GCP service account JSON{ "type": "service_account", "project_id": "...", "private_key_id": "...", "private_key": "[REDACTED private-key]
Use it
Copy one of these into your project. Installing also returns the manifest and these snippets.
yaml
targets:
- https://api.opensmartroute.ai/api/v1/registry/elementalsouls-claude-bughunter-cloud-iam-deep/manifest # or paste the manifest below
Manifest
An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.
{
"ocm": "1",
"id": "elementalsouls-claude-bughunter-cloud-iam-deep",
"kind": "skill",
"name": "cloud-iam-deep",
"description": "Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.",
"publisher": "elementalsouls",
"version": "1.0.0",
"capabilities": {
"domains": [
"coding",
"math"
],
"tags": [
"skill-md",
"github"
],
"languages": [
"en"
]
},
"quality_prior": 0.6,
"examples": [
"Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain."
],
"primary": false,
"metadata": {
"source": {
"provider": "github",
"repository": "https://github.com/elementalsouls/Claude-BugHunter",
"path": "skills/cloud-iam-deep/SKILL.md",
"ref": "8f62b97be953d71bb1d7956b0dbce2cbaf5dea38",
"url": "https://github.com/elementalsouls/Claude-BugHunter/blob/8f62b97be953d71bb1d7956b0dbce2cbaf5dea38/skills/cloud-iam-deep/SKILL.md",
"key": "elementalsouls/Claude-BugHunter/skills/cloud-iam-deep/SKILL.md"
}
},
"instructions": "## When to use\n\nTrigger when:\n- A cloud credential surfaces (key, secret, token, JSON file)\n- SSRF chain reaches IMDS / metadata endpoint\n- APK / git-leak reveals embedded cloud key\n- Recon shows public S3/GCS/Azure-blob with permissions you can verify\n- A Kubernetes API or service-account token is exposed\n- Post-RCE on a cloud-hosted instance — pivot to cloud control plane\n\nDo NOT use for:\n- On-prem-only environments (use AD attack skills — but those are out of scope per external-only boundary)\n- Web2 vulns that happen to be on AWS — use the relevant `hunt-*` skill\n\n---\n\n## Credential identif",
"cost": {
"context_tokens": 341
}
}
Fetch it by URL: GET /api/v1/registry/elementalsouls-claude-bughunter-cloud-iam-deep/manifest?version=1.0.0
Reviews
Star ratings from people who tried it. One review per account; edit yours any time.
No reviews yet. Install it, try it, and be the first to rate it.
