当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
The automated check flagged lines worth reading first. See the safety section below.
$ npx skills add zhaji2333/CkSKILLS --skill cloud-infra-supply-chain -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install zhaji2333/CkSKILLS cloud-infra-supply-chain --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/cloud-infra-supply-chain .claude/skills/cloud-infra-supply-chain && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "cloud-infra-supply-chain" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/cloud-infra-supply-chain into .claude/skills/cloud-infra-supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-infra-supply-chain", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/cloud-infra-supply-chainType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add zhaji2333/CkSKILLS --skill cloud-infra-supply-chain -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install zhaji2333/CkSKILLS cloud-infra-supply-chain --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/cloud-infra-supply-chain .agents/skills/cloud-infra-supply-chain && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "cloud-infra-supply-chain" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/cloud-infra-supply-chain into .agents/skills/cloud-infra-supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-infra-supply-chain", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill cloud-infra-supply-chain -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install zhaji2333/CkSKILLS cloud-infra-supply-chain --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/cloud-infra-supply-chain .cursor/skills/cloud-infra-supply-chain && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "cloud-infra-supply-chain" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/cloud-infra-supply-chain into .cursor/skills/cloud-infra-supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-infra-supply-chain", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/zhaji2333/CkSKILLS.git --path .agents/skills/cloud-infra-supply-chain--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add zhaji2333/CkSKILLS --skill cloud-infra-supply-chain -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install zhaji2333/CkSKILLS cloud-infra-supply-chain --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/cloud-infra-supply-chain .gemini/skills/cloud-infra-supply-chain && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "cloud-infra-supply-chain" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/cloud-infra-supply-chain into .gemini/skills/cloud-infra-supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-infra-supply-chain", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install zhaji2333/CkSKILLS cloud-infra-supply-chainInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add zhaji2333/CkSKILLS --skill cloud-infra-supply-chain -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/cloud-infra-supply-chain .github/skills/cloud-infra-supply-chain && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "cloud-infra-supply-chain" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/cloud-infra-supply-chain into .github/skills/cloud-infra-supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-infra-supply-chain", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill cloud-infra-supply-chain -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install zhaji2333/CkSKILLS cloud-infra-supply-chain --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/cloud-infra-supply-chain .opencode/skills/cloud-infra-supply-chain && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "cloud-infra-supply-chain" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/cloud-infra-supply-chain into .opencode/skills/cloud-infra-supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cloud-infra-supply-chain", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
cloud-infra-supply-chain当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
Cloud Infra Supply Chain is an agent skill from zhaji2333/CkSKILLS. 当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
Its SKILL.md is about 690 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in DevOps & Cloud, covering Supply chain security, Vulnerability scanning and Container orchestration. It works with GitLab, Jenkins, Kubernetes and Grafana. The repository describes itself as: 基于 Claude Code / Codex 的 SRC 漏洞挖掘 Agent 技能体系 —— 将顶尖安全研究员的方法论沉淀为可调度、可复用的 Skill 知识资产。 The licence is MIT.
Read from SKILL.md and the folder at commit 482fe78. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
metadata.tencentyun.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Cloud Infra Supply Chain loads about 688 tokens when it runs. Until then it costs about 47 tokens; SKILL.md has 150 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found patterns that need a careful read before installing.
- 阿里云: http://100.100.100.200/latest/meta-data/Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from zhaji2333/CkSKILLS at commit 482fe78, republished under its MIT licence (© zhaji2333). 150 words, ~688 tokens.
.claude/skills/cloud-infra-supply-chain/SKILL.md (or your agent's skills folder).| 场景 | 漏洞类型 | 挖掘要点 |
|---|---|---|
| 后台登录 | 弱口令/默认口令/爆破 | admin:admin、无验证码、无锁定 |
| 数据库管理(phpMyAdmin等) | 未授权/弱口令/SQL执行 | 默认路径、弱密码 |
| 服务器面板(宝塔/cPanel) | 未授权/RCE | 默认端口、已知CVE |
| 监控系统(Zabbix/Grafana) | 未授权/SSRF/SQL注入 | 默认凭证、API未鉴权 |
| 日志系统(ELK/Splunk) | 未授权/敏感信息 | Kibana未鉴权、日志含密码 |
| CI/CD(Jenkins/GitLab) | 未授权/RCE/凭证泄露 | 匿名构建、密钥泄露、命令执行 |
| 容器管理(Docker/K8s) | 未授权/逃逸/提权 | Docker API暴露、Dashboard弱口令 |
| 配置中心(Nacos/Apollo) | 未授权/配置泄露 | 默认账号、API未鉴权 |
| 场景 | 漏洞类型 | 挖掘要点 |
|---|---|---|
| 支付回调(支付宝/微信) | 签名绕过/参数篡改 | 签名校验缺失、notify_url可控 |
| 短信网关 | 短信轰炸/内容可控 | 无频率限制、短信模板可控 |
| 邮件服务 | 邮件头注入/钓鱼 | 收件人可控、内容可控 |
| CDN/OSS | 配置错误/越权访问 | Bucket公开、签名URL泄露 |
| 地图/定位API | 信息泄露/Key泄露 | 泄露内部地址、API密钥硬编码 |
| 消息队列(Kafka/RabbitMQ) | 未授权访问/消息伪造 | 管理接口暴露、消息可注入 |
| 缓存服务(Redis/Memcached) | 未授权访问/数据泄露 | 默认端口无密码 |
| 微服务网关 | 路由绕过/鉴权绕过 | 路径标准化差异、Header注入 |
云元数据：
- AWS: http://169.254.169.254/latest/meta-data/
- 阿里云: http://100.100.100.200/latest/meta-data/
- 腾讯云: http://metadata.tencentyun.com/latest/meta-data/
Kubernetes:
- ServiceAccount Token泄露
- etcd未授权访问
- Dashboard弱口令
Serverless:
- 函数环境变量泄露
- 临时凭证获取
- 事件注入
对象存储:
- Bucket公开可读/写
- 预签名URL泄露
- ACL配置错误SSRF 打云元数据的完整手法见
ssrf-internal-network技能。
.map 文件、配置文件| 类型 | 场景 |
|---|---|
| L1. 组件CVE | SBOM/依赖清单、版本比对 |
| L2. 云/容器错误配置 | 公开存储桶、弱IAM、裸奔Dashboard |
| L3. CI/CD密钥泄露 | 流水线日志、环境变量、仓库历史 |
| 场景 | 漏洞类型 | 挖掘要点 |
|---|---|---|
| AI/大模型接口 | Prompt注入/敏感信息 | 提示词泄露、越权调用、输出敏感数据 |
| 区块链/Web3 | 智能合约漏洞/私钥泄露 | 重入攻击、权限控制、密钥硬编码 |
| Serverless函数 | 注入/环境变量泄露 | 事件注入、临时凭证获取 |
| 低代码平台 | 表达式注入/越权 | 公式执行、流程绕过 |
© zhaji2333, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in .agents/skills/cloud-infra-supply-chain of zhaji2333/CkSKILLS.
Open the folder on GitHubat commit 482fe78
Cloud Infra Supply Chain next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Cloud Infra Supply Chain this skillzhaji2333/CkSKILLS | 115 | — | ~688 | Automated safety check: Warn | MIT | |
| Performing Container Security Scanning With Trivymukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~818 | Automated safety check: Pass | Apache-2.0 | |
| Infrastructure Devops Devops Engineerchendongqi/OPB-Skills | 126 | — | ~1.4k | Automated safety check: Pass | None | |
| CI/CD Pipeline Principlesirahardianto/awesome-agv | 156 | — | ~2.7k | Automated safety check: Notes | MIT | |
| Alloygrafana/skills | 282 | — | ~1.3k | Automated safety check: Pass | Apache-2.0 | |
| Container Securityhardw00t/ai-security-arsenal | 105 | — | ~2.8k | Automated safety check: Pass | None |
mukul975/Anthropic-Cybersecurity-Skills
Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed…
chendongqi/OPB-Skills
DevOps助手 - 专业的DevOps实践与自动化专家。适用场景： (1) CI/CD流水线设计与实现 (2) 部署策略与发布管理 (3) 基础设施即代码（IaC） (4) 容器化与Kubernetes部署 (5) 监控告警与可观测性 (6) DevOps工具链选型 (7) DevOps文化与实践推广 触发关键词：DevOps、CI/CD、持续集成、持续部署、Jenkins、GitLab…
irahardianto/awesome-agv
Rules for designing CI/CD pipelines in layers: universal lint, test and scan stages, container builds with SBOM attestation, and GitOps for orchestrated deployments.
grafana/skills
Build a unified telemetry pipeline with Grafana Alloy — one OpenTelemetry-compatible binary that collects metrics, logs, traces, and profiles and ships to Grafana Cloud / Prometheus / Loki / Tempo /…
hardw00t/ai-security-arsenal
Container and Kubernetes security assessment — image vulnerability scanning, SBOM diff analysis, K8s cluster auditing, RBAC privilege mapping, NetworkPolicy review, container escape testing, and…
AgentSecOps/SecOpsAgentKit
Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…
zhaji2333/CkSKILLS
当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物，或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物（壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取）→ 标准目录交付。命中场景：JADX 打开是…
zhaji2333/CkSKILLS
当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门，或 APK 过大（100MB）JADX 全量反编译过慢、内存吃紧，或脱壳产物（裸 dex）需要快速检索，或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位（findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…
zhaji2333/CkSKILLS
当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。
zhaji2333/CkSKILLS
当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型，或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析，或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…
zhaji2333/CkSKILLS
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板，或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板（读→挖→写回），不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
zhaji2333/CkSKILLS
当发现参数拼接SQL、动态排序/筛选、JSON查询条件可控、模板渲染、命令执行点、搜索/统计/自动补全接口时调用，进行SQL/NoSQL/命令/SSTI/表达式注入的深度挖掘。命中场景：搜索框、排序参数、登录绕过、导出条件、文件名参数、模板/报表生成、爬虫URL参数。
Categories
当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。. Cloud Infra Supply Chain is an agent skill from zhaji2333/CkSKILLS.
Cloud Infra Supply Chain fits situations like: tasks that involve Supply chain security; tasks that involve Vulnerability scanning; tasks that involve Container orchestration.
Run `npx skills add zhaji2333/CkSKILLS --skill cloud-infra-supply-chain -a claude-code`. Or copy the skill folder (.agents/skills/cloud-infra-supply-chain in zhaji2333/CkSKILLS) into .claude/skills/cloud-infra-supply-chain in your project. Claude Code loads it when a task matches its description.
Run `npx skills add zhaji2333/CkSKILLS --skill cloud-infra-supply-chain -a codex`. Or copy the skill folder (.agents/skills/cloud-infra-supply-chain in zhaji2333/CkSKILLS) into .agents/skills/cloud-infra-supply-chain in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaji2333/CkSKILLS --skill cloud-infra-supply-chain -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cloud-infra-supply-chain, .gemini/skills/cloud-infra-supply-chain, .github/skills/cloud-infra-supply-chain and .opencode/skills/cloud-infra-supply-chain in your project.
SKILL.md names no scripts, command-line tools or credentials: Cloud Infra Supply Chain is instructions for the agent only. Our summary lists: Docker.
SKILL.md names 1 domain. In commands or code: metadata.tencentyun.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.
Our automated static check of SKILL.md flagged 1 warning(s): links to a raw public ip address. Read the flagged lines before installing; the check is not a guarantee either way.
Cloud Infra Supply Chain is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 688 tokens (SKILL.md is roughly 2.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Cloud Infra Supply Chain: Performing Container Security Scanning With Trivy (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Infrastructure Devops Devops Engineer (chendongqi/OPB-Skills, 126 stars), CI/CD Pipeline Principles (irahardianto/awesome-agv, 156 stars) and Alloy (grafana/skills, 282 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
zhaji2333 (a GitHub user) maintains it in zhaji2333/CkSKILLS, which has 115 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on September 15, 2026.
Source: zhaji2333/CkSKILLS on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
