Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Cloud & Containers · transilienceai | DecimalAI

transilienceai/cloud-containers

SkillScore36Maintained

Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation.

Securityby transilienceai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/transilienceai-cloud-containers/SKILL.md

decimalai skills pull transilienceai-cloud-containers --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/transilienceai-cloud-containers/SKILL.md https://app.decimal.ai/s/transilienceai-cloud-containers/SKILL.md

Raw file: /s/transilienceai-cloud-containers/SKILL.md ↗ · machine-readable summary at /s/transilienceai-cloud-containers.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 17d ago

Yes — +14% lift-5% tokens0% turns36% of whole cases pass with skill (8/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-15	✗→✓	▲ Improved	67%	0%
case-17	✗→✓	▲ Improved	-7%	0%
case-20	✗→✓	▲ Improved	-68%	0%
case-16	✓→✓	＝ Same ✓	-48%	0%
case-18	✓→✓	＝ Same ✓	-76%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

transilienceai / communitytools

skills/cloud-containers/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

Cloud & Containers

Test cloud infrastructure and container environments for security misconfigurations and exploitation paths.

Techniques

| Platform | Key Vectors | |----------|-------------| | AWS | S3 bucket exposure, IAM misconfig, metadata service, Lambda abuse | | Azure | Blob storage, RBAC flaws, managed identity, App Service misconfig | | GCP | Cloud Storage, service account keys, metadata server, IAM | | Docker | Container escape, privileged mode, socket exposure, image vulnerabilities | | Kubernetes | RBAC bypass, secret exposure, pod escape, API server access |

Workflow

Enumerate cloud resources and services
Test IAM/RBAC configurations
Check storage and secrets exposure
Test container isolation and escape paths
Document findings with cloud-specific evidence

Two lanes — attack vs assess

This skill covers both, and they are different jobs producing different artifacts. Do not mix them in one deliverable.

| Lane | You have | You produce | Start at | |---|---|---|---| | Offensive | a cloud target to attack | exploited findings with a PoC | reference/INDEX.md | | Posture | read-only credentials and a "review the configuration" ask | one evidenced verdict per control in a pinned catalogue | reference/posture/INDEX.md |

Reference

reference/INDEX.md - Router for platform-specific attack scenarios (AWS, Azure, GCP, Docker, K8s)
reference/posture/INDEX.md - Credentialed read-only configuration review (CSPM): run order, verdict vocabulary, the four false-pass traps, pinned catalogues, and the licensing rule for benchmark-derived content

Want to see if transilienceai/cloud-containers would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/19/2026, 11:41 UTC · 22 cases

Lift

+14%

36% vs 23%

Agent turns

0%

1.0 vs 1.0

Tokens

-5%

1,991.68 vs 2,093.55

fail → pass · 3pass → pass · 5fail → fail · 14

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I am providing read-only access to our GCP organization for a thorough posture evaluation. Can you audit our IAM policies, cloud storage buckets, and service accounts, and output a detailed compliance report containing individual verdicts and evidence for each audited security control?	fail→fail	22,883	17,210	-25%	1	1	0%	2,017	3,744	+86%	0	0	—
case-02 We need an ethical security assessment against our staging Kubernetes deployment and container runtime environment. Please evaluate potential container breakouts or RBAC flaws, and output a penetration testing report detailing any successful exploitation paths accompanied by step-by-step reproduction steps.	fail→fail	10,960	17,061	+56%	1	1	0%	642	2,481	+286%	0	0	—
case-03 We are developing a Node.js web application and want to write secure source code to prevent SQL injection and cross-site scripting before putting it in a Docker container. Can you perform a static source code review of our application code?	fail→fail	8,341	19,250	+131%	1	1	0%	1,065	2,617	+146%	0	0	—
case-04 We need to set up a CI/CD pipeline in GitHub Actions to build and push Docker images automatically. Can you write the complete GitHub Actions YAML workflow script for deployment?	fail→fail	11,634	8,253	-29%	1	1	0%	2,386	1,909	-20%	0	0	—
case-05 Our on-premise physical rack servers running bare-metal Linux need physical access controls and BIOS password configurations. Can you provide a physical datacenter security checklist?	fail→fail	18,574	14,666	-21%	1	1	0%	2,883	2,653	-8%	0	0	—
case-06 We have granted read-only AWS IAM credentials for an audit of our AWS environment. We want to know if our S3 buckets, IAM roles, metadata service settings, and Lambda functions comply with security standards. Please provide a posture review report.	fail→fail	17,953	13,359	-26%	1	1	0%	3,072	2,680	-13%	0	0	—
case-07 We are conducting a red team engagement against an AWS target where we suspect an exposed S3 bucket and SSRF leading to IMDS. Can you help us exploit the cloud environment and gain administrative access?	fail→fail	9,473	10,619	+12%	1	1	0%	522	1,330	+155%	0	0	—
case-08 Our security team supplied read-only privileges to an Azure subscription. We need a configuration assessment covering Blob storage, Azure RBAC roles, managed identities, and App Service settings. What review procedure and report format should be followed?	fail→fail	17,446	14,159	-19%	1	1	0%	2,944	2,760	-6%	0	0	—
case-09 During an authorized penetration test on Azure, we discovered an exposed storage account blob and an App Service with managed identity enabled. How should we proceed to test RBAC flaws and document exploitation paths?	fail→fail	22,057	18,924	-14%	1	1	0%	1,645	1,931	+17%	0	0	—
case-10 We are testing our GCP staging infrastructure for vector paths like metadata server access, service account key leakage, and Cloud Storage exposures to demonstrate realistic business impact. Please generate an offensive penetration testing report.	fail→fail	14,825	17,973	+21%	1	1	0%	2,341	3,558	+52%	0	0	—
case-11 We have shell access inside a Docker container that appears to run in privileged mode with access to the docker.sock file. Provide an offensive evaluation demonstrating container breakout and host compromise.	fail→fail	16,299	12,565	-23%	1	1	0%	2,622	2,516	-4%	0	0	—
case-12 We provided read-only access to our container host configuration files and Docker daemon configurations. We want an audit of image security, socket permissions, and container runtime flags. How should this assessment be conducted and reported?	fail→fail	22,742	17,049	-25%	1	1	0%	4,002	3,251	-19%	0	0	—
case-13 We are performing an authorized security assessment on a Kubernetes cluster where we suspect overly permissive RBAC and exposed secrets. We need to demonstrate pod escape and API server access. What lane and deliverable should be used?	fail→fail	16,049	12,939	-19%	1	1	0%	1,553	1,323	-15%	0	0	—
case-14 Our cluster administrator gave you read-only kubeconfig access to evaluate cluster RBAC, secret encryption, pod security standards, and API server exposure. Please provide a posture assessment report.	fail→fail	21,122	19,755	-6%	1	1	0%	2,424	2,472	+2%	0	0	—
case-15 We have both read-only credentials and active testing authorization for our cloud target. Can you write a single combined report that lists CIS compliance verdicts and active exploit PoCs together in one unified section?	fail→pass	12,809	17,755	+39%	1	1	0%	1,275	2,132	+67%	0	0	—
case-16 When beginning a cloud and container infrastructure security job, what is the mandatory initial step in the workflow before testing IAM or storage exposure?	pass→pass	9,768	6,469	-34%	1	1	0%	1,478	773	-48%	0	0	—
case-17 After completing initial cloud resource enumeration in the security workflow, what step immediately follows enumeration before testing container escapes?	fail→pass	11,073	5,764	-48%	1	1	0%	930	869	-7%	0	0	—
case-18 Which key vector areas are specifically highlighted for Amazon Web Services infrastructure assessments?	pass→pass	17,014	1,697	-90%	1	1	0%	2,596	636	-76%	0	0	—
case-19 Which key vector areas are specifically designated for Microsoft Azure cloud environments?	pass→pass	12,965	1,780	-86%	1	1	0%	2,045	691	-66%	0	0	—
case-20 What key vector areas are designated for Google Cloud Platform security evaluation?	fail→pass	14,971	6,292	-58%	1	1	0%	2,394	756	-68%	0	0	—
case-21 What key vulnerability vectors are defined for Docker environment testing?	pass→pass	14,880	1,649	-89%	1	1	0%	2,300	637	-72%	0	0	—
case-22 What key attack and review vectors are designated for Kubernetes cluster security?	pass→pass	18,421	10,375	-44%	1	1	0%	2,922	2,098	-28%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +14 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 22.7%
Pass rate with the skill: 36.4%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/19/2026, 11:41 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-15

Prompt

We have both read-only credentials and active testing authorization for our cloud target. Can you write a single combined report that lists CIS compliance verdicts and active exploit PoCs together in one unified section?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run36

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-57% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 16 days ago

Other measured skills in the registry, with their headline benchmark lift.