New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Performing AWS Account Enumeration With Scout Suite

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Run the agentless, open-source ScoutSuite tool (via pip install and the scout CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an…

Apache-2.0Auto-check passedSecurity

Install Performing AWS Account Enumeration With Scout Suite

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-aws-account-enumeration-with-scout-suite -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills performing-aws-account-enumeration-with-scout-suite --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/performing-aws-account-enumeration-with-scout-suite .claude/skills/performing-aws-account-enumeration-with-scout-suite && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
performing-aws-account-enumeration-with-scout-suite
GitHub stars
34k
Token cost
~1.9k tokens
SKILL.md length
513 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Run the agentless, open-source ScoutSuite tool (via pip install and the scout CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an…

  • Works in 4 steps: Dashboard: Overview of findings by… → Service-level findings: Grouped by AWS… → Rule-based checks: Each finding maps to… → …
  • Assessing an AWS accounts overall security posture with read-only IAM credentials
  • SKILL.md covers Overview, When to Use, Prerequisites and Installation and Setup, plus 7 more sections
  • Runs Python scripts from its folder; calls pip, aws and python; needs AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

What it does

Performing AWS Account Enumeration With Scout Suite is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Run the agentless, open-source ScoutSuite tool (via pip install and the scout CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an interactive HTML security report. Use when assessing an AWS account's overall security posture with read-only IAM credentials, such as during a cloud security audit or compliance review.

Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security, covering Cloud security, HTML artifacts and Regulatory compliance. It works with Amazon Web Services. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Assessing an AWS accounts overall security posture with read-only IAM credentials
  • Such as during a cloud security audit
  • Compliance review

Example prompts

  • “/performing-aws-account-enumeration-with-scout-suite”

Requirements

  • Python 3
  • A credential in AWS_SECRET_ACCESS_KEY

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Dashboard: Overview of findings by severity (danger, warning, good)
  2. Service-level findings: Grouped by AWS service (IAM, S3, EC2, RDS, etc.)
  3. Rule-based checks: Each finding maps to a security best practice rule
  4. Resource inventory: Complete listing of enumerated resources

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • pip
    • aws
    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • AWS_ACCESS_KEY_ID
    • AWS_SECRET_ACCESS_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Performing AWS Account Enumeration With Scout Suite loads about 1.9k tokens when it runs, and up to ~4.3k if it reads all its reference files. Until then it costs about 108 tokens; SKILL.md has 513 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~108
When it runs · the whole SKILL.md, loaded when a task matches
~1.9k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 513 words, ~1,884 tokens.

Download SKILL.mdSave it as .claude/skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
performing-aws-account-enumeration-with-scout-suite
description
Run the agentless, open-source ScoutSuite tool (via pip install and the `scout` CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an interactive HTML security report. Use when assessing an AWS account's overall security posture with read-only IAM credentials, such as during a cloud security audit or compliance review.
domain
cybersecurity
subdomain
cloud-security
tags
aws, scoutsuite, cloud-security, enumeration, misconfiguration, security-audit, cspm, nccgroup
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
PR.IR-01, ID.AM-08, GV.SC-06, DE.CM-01
mitre_attack
T1078.004, T1530, T1537, T1580

Performing AWS Account Enumeration with ScoutSuite

Overview

ScoutSuite is an open-source multi-cloud security auditing tool developed by NCC Group that enables comprehensive security posture assessment of AWS environments. It queries AWS APIs to gather configuration data across all services, stores results locally, and generates interactive HTML reports highlighting high-risk areas. ScoutSuite is agentless and works by analyzing how cloud resources are configured, accessed, and monitored.

When to Use

  • When conducting security assessments that involve performing aws account enumeration with scout suite
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Python 3.6+ installed
  • AWS CLI configured with appropriate IAM credentials
  • Read-only IAM permissions across target AWS services (SecurityAudit managed policy recommended)
  • pip package manager for ScoutSuite installation
  • Network access to AWS API endpoints

Installation and Setup

Install ScoutSuite
bash
pip install scoutsuite
Verify installation
bash
scout --version
Configure AWS credentials
bash
aws configure
# Or use environment variables:
export AWS_ACCESS_KEY_ID=<your-key>
export AWS_SECRET_ACCESS_KEY=<your-secret>
export AWS_DEFAULT_REGION=us-east-1
Required IAM Policy

Attach the AWS managed policy SecurityAudit and ViewOnlyAccess to the IAM user or role running ScoutSuite. For comprehensive scanning, a custom policy may be needed:

json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "acm:Describe*",
        "acm:List*",
        "cloudformation:Describe*",
        "cloudformation:Get*",
        "cloudformation:List*",
        "cloudtrail:Describe*",
        "cloudtrail:Get*",
        "cloudtrail:List*",
        "cloudwatch:Describe*",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "config:Describe*",
        "config:Get*",
        "config:List*",
        "dynamodb:Describe*",
        "dynamodb:List*",
        "ec2:Describe*",
        "ec2:Get*",
        "elasticloadbalancing:Describe*",
        "iam:Generate*",
        "iam:Get*",
        "iam:List*",
        "iam:Simulate*",
        "kms:Describe*",
        "kms:Get*",
        "kms:List*",
        "lambda:Get*",
        "lambda:List*",
        "logs:Describe*",
        "logs:Get*",
        "rds:Describe*",
        "rds:List*",
        "redshift:Describe*",
        "route53:Get*",
        "route53:List*",
        "s3:Get*",
        "s3:List*",
        "ses:Get*",
        "ses:List*",
        "sns:Get*",
        "sns:List*",
        "sqs:Get*",
        "sqs:List*",
        "ssm:Describe*",
        "ssm:Get*",
        "ssm:List*"
      ],
      "Resource": "*"
    }
  ]
}

Running ScoutSuite

Full AWS scan
bash
scout aws
Scan specific services only
bash
scout aws --services s3 iam ec2 rds
Scan specific regions
bash
scout aws --regions us-east-1 us-west-2 eu-west-1
Use an assumed role for cross-account scanning
bash
scout aws --profile target-account-profile
Exclude specific services from scan
bash
scout aws --skip iam ec2
Specify output directory
bash
scout aws --report-dir /tmp/scoutsuite-reports/

Report Analysis

ScoutSuite generates an interactive HTML report stored locally. The report includes:

  1. Dashboard: Overview of findings by severity (danger, warning, good)
  2. Service-level findings: Grouped by AWS service (IAM, S3, EC2, RDS, etc.)
  3. Rule-based checks: Each finding maps to a security best practice rule
  4. Resource inventory: Complete listing of enumerated resources
Key areas to review in the report
ServiceCritical Checks
IAMRoot account MFA, password policy, unused credentials, overprivileged policies
S3Public buckets, unencrypted buckets, versioning disabled, logging disabled
EC2Security groups with 0.0.0.0/0, unencrypted EBS volumes, public IPs
RDSPublic accessibility, unencrypted databases, backup retention
CloudTrailLogging disabled, log file validation, multi-region disabled
LambdaPublic access, environment variable secrets, VPC configuration
Show full SKILL.md (192 more words)Show less

Interpreting Findings

Severity Levels
  • Danger (Red): Critical security issues requiring immediate remediation (e.g., S3 buckets with public write access)
  • Warning (Orange): Moderate risk findings that should be addressed (e.g., unused IAM access keys)
  • Good (Green): Security best practices that are properly configured
Common High-Risk Findings
  1. IAM root account without MFA: The AWS root account has no multi-factor authentication enabled
  2. S3 bucket policy allows public access: Bucket policies with Principal set to "*"
  3. Security group allows unrestricted SSH: Inbound rule allowing 0.0.0.0/0 on port 22
  4. CloudTrail not enabled in all regions: Audit logging gaps allow unmonitored API activity
  5. RDS instance publicly accessible: Database endpoints reachable from the internet

Remediation Workflow

  1. Run ScoutSuite scan to establish baseline
  2. Export findings and prioritize by severity
  3. Create remediation tickets for danger and warning findings
  4. Implement fixes (update security groups, enable encryption, restrict access)
  5. Re-run ScoutSuite to verify remediation
  6. Schedule regular scans (weekly or after infrastructure changes)

Integration with CI/CD

bash
# Run ScoutSuite in CI/CD pipeline and fail on danger findings
scout aws --services s3 iam ec2 --no-browser --report-dir ./scout-report/

# Parse results programmatically
python -c "
import json
with open('./scout-report/scoutsuite-results/scoutsuite_results.json') as f:
    results = json.load(f)
    for service in results.get('services', {}):
        findings = results['services'][service].get('findings', {})
        for finding_id, finding in findings.items():
            if finding.get('flagged_items', 0) > 0 and finding.get('level') == 'danger':
                print(f'CRITICAL: {finding_id} - {finding.get(\"description\", \"\")}')
"

Multi-Cloud Capability

ScoutSuite supports multiple cloud providers using the same framework:

bash
# Azure
scout azure --cli

# GCP
scout gcp --user-account

# AWS with specific profile
scout aws --profile production

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/performing-aws-account-enumeration-with-scout-suite of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Performing AWS Account Enumeration With Scout Suite next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Performing AWS Account Enumeration With Scout Suite compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Performing AWS Account Enumeration With Scout Suite this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.9kAutomated safety check: PassApache-2.0
Cloud Auditbriiirussell/cybersecurity-skills413—~1.3kAutomated safety check: NotesMIT
AWS Security ArchitectureHack23/cia239—~2.3kAutomated safety check: PassApache-2.0
AWS Iamsickn33/agentic-awesome-skills47k2 repos~3.4kAutomated safety check: PassMIT
Configuring Firewallsancoleman/ai-design-components525—~3.5kAutomated safety check: NotesMIT
AWS Account Managementhoodini/ai-agents-skills282—~3.5kAutomated safety check: PassNone

Similar skills

  • Cloud Audit

    briiirussell/cybersecurity-skills

    Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps.

    413 GitHub stars~1.3k tokensUpdated 4 mo ago
    SecurityAuto-check: notes

  • AWS Security Architecture

    Hack23/cia

    AWS security best practices, VPC security, IAM, KMS, CloudTrail, GuardDuty for CIA platform deployment

    239 GitHub stars~2.3k tokensUpdated today
    SecurityAuto-check passed

  • AWS Iam

    sickn33/agentic-awesome-skills

    Manage IAM users, roles, and policies. An agent skill from sickn33/agentic-awesome-skills.

    47k GitHub starsUsed in 2 repos~3.4k tokens
    SecurityAuto-check passed

  • Configuring Firewalls

    ancoleman/ai-design-components

    Configure host-based firewalls (iptables, nftables, UFW) and cloud security groups (AWS, GCP, Azure) with practical rules for common scenarios like web servers, databases, and bastion hosts.

    525 GitHub stars~3.5k tokensUpdated 10 mo ago
    SecurityAuto-check: notes

  • AWS Account Management

    hoodini/ai-agents-skills

    Manage AWS accounts, organizations, IAM, and billing. An agent skill from hoodini/ai-agents-skills.

    282 GitHub stars~3.5k tokensUpdated 3 mo ago
    SecurityAuto-check passed

  • Hardening Cloud Posture

    trilwu/secskills

    Proactively harden a cloud account or organization before an incident — prioritizing IAM and identity risk over checkbox findings, closing the exposures that become attack paths (public storage…

    157 GitHub stars~1.9k tokensUpdated 1 mo ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Performing AWS Account Enumeration With Scout Suite

What does Performing AWS Account Enumeration With Scout Suite do?

Run the agentless, open-source ScoutSuite tool (via pip install and the scout CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an…. Performing AWS Account Enumeration With Scout Suite is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Run the agentless, open-source ScoutSuite tool (via pip install and the scout CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an interactive HTML security report.

When should I use Performing AWS Account Enumeration With Scout Suite?

Performing AWS Account Enumeration With Scout Suite fits situations like: assessing an AWS accounts overall security posture with read-only IAM credentials; such as during a cloud security audit; compliance review.

How do I install Performing AWS Account Enumeration With Scout Suite in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-aws-account-enumeration-with-scout-suite -a claude-code`. Or copy the skill folder (skills/performing-aws-account-enumeration-with-scout-suite in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/performing-aws-account-enumeration-with-scout-suite in your project. Claude Code loads it when a task matches its description.

How do I install Performing AWS Account Enumeration With Scout Suite in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-aws-account-enumeration-with-scout-suite -a codex`. Or copy the skill folder (skills/performing-aws-account-enumeration-with-scout-suite in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/performing-aws-account-enumeration-with-scout-suite in your project. Codex loads it when a task matches its description.

Can I use Performing AWS Account Enumeration With Scout Suite in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-aws-account-enumeration-with-scout-suite -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/performing-aws-account-enumeration-with-scout-suite, .gemini/skills/performing-aws-account-enumeration-with-scout-suite, .github/skills/performing-aws-account-enumeration-with-scout-suite and .opencode/skills/performing-aws-account-enumeration-with-scout-suite in your project.

What does Performing AWS Account Enumeration With Scout Suite need to run?

Going by SKILL.md and its folder, Performing AWS Account Enumeration With Scout Suite needs Python for the scripts in its folder, the command-line tools its instructions call (pip, aws and python) and credentials named AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Our summary lists: Python 3; A credential in AWS_SECRET_ACCESS_KEY.

Does Performing AWS Account Enumeration With Scout Suite access the network?

SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.

Is Performing AWS Account Enumeration With Scout Suite safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Performing AWS Account Enumeration With Scout Suite use?

Performing AWS Account Enumeration With Scout Suite is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Performing AWS Account Enumeration With Scout Suite use?

About 1.9k tokens (SKILL.md is roughly 7.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.4k tokens, read only when the agent opens those files.

What are the alternatives to Performing AWS Account Enumeration With Scout Suite?

Skills that share tags, products or a category with Performing AWS Account Enumeration With Scout Suite: Cloud Audit (briiirussell/cybersecurity-skills, 413 stars), AWS Security Architecture (Hack23/cia, 239 stars), AWS Iam (sickn33/agentic-awesome-skills, 47k stars) and Configuring Firewalls (ancoleman/ai-design-components, 525 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Performing AWS Account Enumeration With Scout Suite?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.