Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →mukul975/enumerating-cloud-with-cloudfox
Map AWS and Azure attack paths and find exploitable misconfigurations with CloudFox.
Passed 13 of 22 test cases with the skill, and 11 of 22 without it.
3 fixed11 passed either way9 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
After gathering IAM policies, we want to simulate IAM evaluation in AWS for our current profile `assess` to verify effective access. What CloudFox subcommand executes the IAM simulation engine?
| Checked | Without skill | With skill |
|---|---|---|
| Uses the subcommand `iam-simulator`. | Missed | Passed |
| Explains that this validates whether specific API actions are permitted for a given identity. | Passed | Passed |
The instructions your model reads when the skill loads.
Legal Notice: This skill is for authorized cloud penetration testing and assessment only. CloudFox makes read/describe API calls against the cloud account whose credentials you supply. Run it ONLY against accounts you own or are authorized to test under a signed scope. Although CloudFox is read-only by design, the enumeration it performs is reconnaissance against a live environment and must be in scope.
CloudFox is an open-source command-line tool from Bishop Fox that helps penetration testers and red teamers gain situational awareness in unfamiliar cloud environments. Where tools like ScoutSuite focus on a defender-style configuration audit, CloudFox is built from the attacker's perspective: it answers questions like "what are the most attackable secrets, endpoints, and instances in this account, and what can the identity I just compromised actually reach?" It is read-only — it only performs Describe/List/Get style calls — and writes its findings to per-command CSV/TXT/loot files plus a combined report directory, so output can be triaged offline.
CloudFox covers AWS most deeply (30+ commands) and supports Azure. The workhorse is cloudfox aws all-checks, which runs the full battery of enumeration commands with sensible defaults: inventory, internet-reachable endpoints, EC2 instances (with IPs and instance-profile roles), iam-simulator and permissions for IAM analysis, principals, secrets from Secrets Manager/SSM, buckets, role-trusts (which identities can assume which roles — a core attack-path primitive), access-keys, route53, ecr, lambda, and more. CloudFox also emits ready-to-run command suggestions (e.g. aws s3 ls lines, aws ssm start-session lines) in its "loot" files so an operator can pivot immediately.
This skill covers installing CloudFox, authenticating to AWS and Azure, running targeted and full enumeration, interpreting the high-value outputs (role-trusts, secrets, endpoints), and feeding the results into attack-path planning. Source: github.com/BishopFox/cloudfox.
sts:AssumeRole trust relationships to plan lateral movement / privesc# Homebrew
brew install cloudfox
# Go (1.21+)
go install github.com/BishopFox/cloudfox@latest
# or download a release binary from GitHub and chmod +x
# AWS — configure a named profile and verify
aws configure --profile assess
aws sts get-caller-identity --profile assess
# Azure
az login
az account show
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.