# Cloud Saas Exposure

Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob...

- Repository: https://github.com/elementalsouls/Claude-OSINT (2943 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-10-20
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-OSINT --skill cloud-saas-exposure -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-OSINT --skill cloud-saas-exposure -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-OSINT --skill cloud-saas-exposure -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-OSINT --skill cloud-saas-exposure -g -a gemini-cli -y`

## Description

Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining (CNAME/cert-SAN/Wayback) and bounded two-class permutation (6 prefixes x 15 suffixes on trusted tokens, bounded target-bound expansion on subdomain stems), existence (HEAD/GET) vs public-listing confirmation, object-key triage into 9 value tiers (database dumps, credentials, IaC state, kubeconfig, VCS dirs, config, archives, PII, logs), dangling-CNAME bucket-takeover detection, and the ownership-gated severity model that stops an unattributable public bucket from becoming a false CRITICAL; the fully offline AWS-account-ID recovery from a leaked AKIA/ASIA/AROA access key (base32 decode, runnable stdlib Python, canonical test vector, AWS-documentation-example-ID screening); dependency-confusion confirmation for npm/PyPI (internal-signal classifier -- private-registry binding vs org-namespace match -- paired with a read-only public-registry 404 check and the npm scope-claimability nuance the public search API misses); and passive cloud-native/container/Kubernetes/CI control-plane fingerprinting (Lambda URLs, API Gateway, Cloud Run, App Service, kubelet/etcd/K8s API/dashboard, Jenkins/GitLab/Argo CD) as an org-attribution and exposure surface. Passive/discovery only -- no exploitation, no credential submission, no active control-plane confirmation (a stage-6 validate_cloud active tier is described but out of scope). Use when enumerating a target's cloud 

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Cloud & SaaS Exposure, Buckets, Offline AWS Account-ID Recovery, Dependency Confusion, and Cloud-Native/K8s Fingerprinting

> Companion skills: `osint-methodology` (the pipeline this plugs into, Stage 2 asset
> expansion, Stage 4 exposure analysis, Stage 5 supply-chain confirmation). `offensive-osint`
> §16.8 (bucket-permutation raw wordlist), §16.17 (cloud-native URL pattern table), §16.18, > §16.19 (container/K8s/CI paths + active curl recipes), §44 (package-registry search). This
> skill does not repeat those lists, it builds the reasoning layer on top: the
> ownership-gated bucket severity model, the offline AKIA→account-ID decode, the
> dependency-confusion two-part confirmation contract, and cloud-native/K8s as an
> org-attribution surface, not just another probe list.

## 0. When to Use / When NOT

**Use this skill when:** you're mapping an authorized target's cloud and supply-chain
footprint, enumerating storage buckets and judging whether a hit is actually the target's
risk (not a stranger's public bucket that happens to match a permutation); recovering the
AWS account ID behind a leaked access key you already hold (dead or live); confirming
whether an internal-looking npm/PyPI dependency is a registerable supply-chain vector; or
fingerprinting cloud-native (Lambda/Cloud Run/App Service/…) and container/K8s/CI
control-plane surface for org attribution and exposure triage.

**Do NOT use this skill when:** you just need the raw bucket-permutation wordlist,
cloud-native URL pattern table, or container/K8s/CI path list with no reasoning layer, go
straight to `offensive-osint` §16.8/§16.17, 16.19/§44. Do NOT use it for anything past
discovery/confirmation: registering an unclaimed package, submitting AWS credentials,
authenticating to a Kubernetes API, or confirming a fingerprinted control plane actually
answers unauthenticated (that's a stage-6 `--validate --validate-cloud` active tier, described, never performed, §5/§9.4).

---

The rest: https://github.com/elementalsouls/Claude-OSINT/blob/HEAD/skills/cloud-saas-exposure/SKILL.md