Hunting For Living Off The Cloud Techniques
mukul975/Anthropic-Cybersecurity-Skills
Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP, and SaaS platforms) for command-and-control, data staging, and exfiltration, i.e.
Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step.
Install Cloud Defense
$ npx skills add transilienceai/communitytools --skill cloud-defense -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install transilienceai/communitytools cloud-defense --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/cloud-defense .claude/skills/cloud-defense && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "cloud-defense" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cloud-defense into .claude/skills/cloud-defense/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-defense", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/transilienceai/communitytools/tree/main/skills/cloud-defenseType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add transilienceai/communitytools --skill cloud-defense -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install transilienceai/communitytools cloud-defense --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/cloud-defense .agents/skills/cloud-defense && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "cloud-defense" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cloud-defense into .agents/skills/cloud-defense/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-defense", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add transilienceai/communitytools --skill cloud-defense -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install transilienceai/communitytools cloud-defense --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/cloud-defense .cursor/skills/cloud-defense && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "cloud-defense" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cloud-defense into .cursor/skills/cloud-defense/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-defense", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/transilienceai/communitytools.git --path skills/cloud-defense--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add transilienceai/communitytools --skill cloud-defense -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install transilienceai/communitytools cloud-defense --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/cloud-defense .gemini/skills/cloud-defense && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "cloud-defense" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cloud-defense into .gemini/skills/cloud-defense/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-defense", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install transilienceai/communitytools cloud-defenseInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add transilienceai/communitytools --skill cloud-defense -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/cloud-defense .github/skills/cloud-defense && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "cloud-defense" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cloud-defense into .github/skills/cloud-defense/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-defense", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add transilienceai/communitytools --skill cloud-defense -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install transilienceai/communitytools cloud-defense --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/cloud-defense .opencode/skills/cloud-defense && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "cloud-defense" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/cloud-defense into .opencode/skills/cloud-defense/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-defense", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
cloud-defense- GitHub stars
- 562
- Token cost
- ~476 tokens
- SKILL.md length
- 162 words
- Files
- 4
- Skills in repo
- 35
- Repo updated
- First seen
- Licence
- MIT
At a glance
Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step.
- Works in 4 steps: Confirm the logging prerequisites are in… → Map each attacker stage to its detection… → Apply the preventive control that breaks… → …
- Cloud detection engineering
- SKILL.md covers When to use, Workflow and References
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Cloud Defense is an agent skill from transilienceai/communitytools. Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use for cloud detection engineering, hardening, remediation write-ups, or blue-team posture review of the lateral-movement - privilege-escalation - exfiltration - evasion chain.
Its SKILL.md is about 480 tokens, which your agent loads only when the skill is triggered. The skill folder holds 4 other files (for example `reference/INDEX.md`, `reference/detection-signals.md` and `reference/hardening-controls.md`).
It sits in Security, covering Red teaming and adversary simulation and Security operations. It works with Amazon Web Services, Google Cloud and Microsoft Azure. The repository describes itself as: Open-source Claude Code skills, agents, and slash commands for AI-powered penetration testing, bug bounty hunting, and security research. The licence is MIT.
When your agent uses it
- Cloud detection engineering
- Remediation write-ups
- Blue-team posture review of the lateral-movement - privilege-escalation - exfiltration - evasion chain
Example prompts
- “/cloud-defense”
Workflow steps
4 steps, taken from the first numbered list in SKILL.md.
- Confirm the logging prerequisites are in place (org-wide trail, data events, threat detection on) — without them the signals below are…
- Map each attacker stage to its detection signal — see reference/detection-signals.md.
- Apply the preventive control that breaks each stage — see reference/hardening-controls.md.
- Re-run the matching offensive technique from cloud-containers to confirm the control holds or the alert fires.
What it can do on your machine
Read from SKILL.md and the folder at commit 95fdc12. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Cloud Defense loads about 476 tokens when it runs. Until then it costs about 97 tokens; SKILL.md has 162 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from transilienceai/communitytools at commit 95fdc12, republished under its MIT licence (© transilienceai). 162 words, ~476 tokens.
Download SKILL.mdSave it as
.claude/skills/cloud-defense/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.- name
- cloud-defense
- description
- Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use for cloud detection engineering, hardening, remediation write-ups, or blue-team posture review of the lateral-movement -> privilege-escalation -> exfiltration -> evasion chain.
Cloud Defense
The blue-team counterpart to cloud-containers. For each attacker move — lateral movement, privilege escalation, data exfiltration, defense evasion — this skill gives the log event to alert on and the single control that removes the technique. Use it to turn an offensive cloud finding into a concrete detection and remediation.
When to use
- Writing the remediation / hardening section of a cloud pentest report.
- Cloud detection engineering: deciding which control-plane events to alert on.
- Reviewing an AWS / Azure / GCP account's posture against the post-compromise chain.
Workflow
- Confirm the logging prerequisites are in place (org-wide trail, data events, threat detection on) — without them the signals below are invisible.
- Map each attacker stage to its detection signal — see reference/detection-signals.md.
- Apply the preventive control that breaks each stage — see reference/hardening-controls.md.
- Re-run the matching offensive technique from
cloud-containersto confirm the control holds or the alert fires.
References
- reference/INDEX.md — router
- reference/detection-signals.md — per-stage log signals + logging prerequisites
- reference/hardening-controls.md — the control that breaks each stage
© transilienceai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 3 other files in skills/cloud-defense of transilienceai/communitytools.
- SKILL.md
- reference/INDEX.md
- reference/detection-signals.md
- reference/hardening-controls.md
Open the folder on GitHubat commit 95fdc12
Compare with similar skills
Cloud Defense next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Cloud Defense this skilltransilienceai/communitytools | 562 | — | ~476 | Automated safety check: Pass | MIT | |
| Hunting For Living Off The Cloud Techniquesmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~925 | Automated safety check: Pass | Apache-2.0 | |
| Performing Cloud Incident Containment Proceduresmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.8k | Automated safety check: Pass | Apache-2.0 | |
| Building Cloud Siem With Sentinelmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.3k | Automated safety check: Pass | Apache-2.0 | |
| Implementing Zero Trust Network Accessmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.3k | Automated safety check: Pass | Apache-2.0 | |
| Investigating GCP Incidentstrilwu/secskills | 157 | — | ~2.2k | Automated safety check: Pass | MIT |
Similar skills
Performing Cloud Incident Containment Procedures
mukul975/Anthropic-Cybersecurity-Skills
Execute cloud-native incident containment across AWS, Azure, and GCP using platform CLIs to revoke or disable compromised IAM credentials, isolate resources with security groups and network ACLs…
Building Cloud Siem With Sentinel
mukul975/Anthropic-Cybersecurity-Skills
Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps…
Implementing Zero Trust Network Access
mukul975/Anthropic-Cybersecurity-Skills
Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, and continuous verification with conditional access policies, replacing VPN-based…
Investigating GCP Incidents
trilwu/secskills
Investigate a security incident in Google Cloud — establishing what audit logging exists before trusting a gap, reconstructing activity from Cloud Audit Logs, triaging service-account and OAuth…
Defender For Cloud Hardening
vinayaklatthe/microsoft-security-skills
Guidance for Microsoft Defender for Cloud — cloud security posture management (CSPM) and cloud workload protection (CWPP) across Azure, AWS, and GCP.
More from transilienceai/communitytools
All 35 skills in this repoDfir
transilienceai/communitytools
Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.
GitHub Workflow
transilienceai/communitytools
GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review.
Pci Secure Software
transilienceai/communitytools
Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation.
Protect With Password
transilienceai/communitytools
Generate ONE strong password and apply it to each referenced file (PDF, Word, Excel, PowerPoint, or any type).
Skill Update
transilienceai/communitytools
Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits.
Source Code Scanning
transilienceai/communitytools
Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.
Related
Categories
Questions about Cloud Defense
What does Cloud Defense do?
Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Cloud Defense is an agent skill from transilienceai/communitytools. Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step.
When should I use Cloud Defense?
Cloud Defense fits situations like: cloud detection engineering; remediation write-ups; blue-team posture review of the lateral-movement - privilege-escalation - exfiltration - evasion chain.
How do I install Cloud Defense in Claude Code?
Run `npx skills add transilienceai/communitytools --skill cloud-defense -a claude-code`. Or copy the skill folder (skills/cloud-defense in transilienceai/communitytools) into .claude/skills/cloud-defense in your project. Claude Code loads it when a task matches its description.
How do I install Cloud Defense in Codex?
Run `npx skills add transilienceai/communitytools --skill cloud-defense -a codex`. Or copy the skill folder (skills/cloud-defense in transilienceai/communitytools) into .agents/skills/cloud-defense in your project. Codex loads it when a task matches its description.
Can I use Cloud Defense in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add transilienceai/communitytools --skill cloud-defense -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cloud-defense, .gemini/skills/cloud-defense, .github/skills/cloud-defense and .opencode/skills/cloud-defense in your project.
What does Cloud Defense need to run?
SKILL.md names no scripts, command-line tools or credentials: Cloud Defense is instructions for the agent only.
Does Cloud Defense access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Cloud Defense safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Cloud Defense use?
Cloud Defense is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Cloud Defense use?
About 476 tokens (SKILL.md is roughly 1.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Cloud Defense?
Skills that share tags, products or a category with Cloud Defense: Hunting For Living Off The Cloud Techniques (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Performing Cloud Incident Containment Procedures (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Building Cloud Siem With Sentinel (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Implementing Zero Trust Network Access (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Cloud Defense?
transilienceai (a GitHub organization) maintains it in transilienceai/communitytools, which has 562 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on July 29, 2026.
Source: transilienceai/communitytools on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.