Menu

Individual skill

cloud-credential-abuse

0upvotes

Provider-aware credential abuse — validating found AWS keys/tokens, Azure ARM/Graph/refresh tokens, and GCP service-account credentials, identifying principals, audiences, effective permissions, and escalation paths, transitioning Xalgorix into credentialed cloud attack mode

internal/tools/skills/data/cloud-security/cloud-credential-abuse/SKILL.md

Read pinned source

Source commit d42f381ad34843e71a42658e5c57290c713e85af

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Instructions only
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,317
Repository last updated
Nov 8, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Cloud Credential Abuse

## Purpose
Answer: "Xalgorix found a cloud credential/token — what happens next?" Validate it cheaply, identify exactly what it is, expand it into durable identity context, and route to the right escalation path. Invalid credentials are discarded quickly; valid ones become attack-surface state.

## Entry Conditions
- A discovered credential: from file disclosure, metadata chains, JS/config exposure, secret vaults, git history, phishing-captured context, or operator-supplied scope
- Care with handling: record provenance and attributes; use via provider CLIs from the test environment

## Discovery Signals (what a credential looks like)
```text
AWS   : AccessKeyId (AKIA/ASIA...), SecretAccessKey, SessionToken (ASIA = temporary/session),
        ~/.aws/credentials, AWS_* env vars, instance-role JSON
Azure : ARM tokens (aud=management.azure.com), Graph tokens, refresh tokens,
Back to top