Skill UI

Offensive cloud security methodology for AWS, Azure, and GCP. Covers identity discovery, credential harvesting, enumeration, privilege escalation, persistence, data exfiltration, lateral movement, serverless abuse, Kubernetes paths, and detection evasion during authorized assessments.

This skill uses Python and boto3 to analyze AWS CloudTrail logs. It establishes statistical baselines of normal API activity and detects various anomalies, such as unusual event sources, first-time API usage, geographic IP deviations, and high-frequency calls. This is critical for identifying credential compromise, privilege escalation, and unauthorized resource access in a security incident.

This skill provides defense-in-depth security controls for AI agents, covering prompt injection detection, input validation, tool abuse prevention, data exfiltration mitigation, and privilege escalation protection. It includes threat modeling with STRIDE, code examples for input sanitization, and guidance for secure agent deployment.