hunt-cloud-misconfig

Name: hunt-cloud-misconfig
Availability: InStock
Author: entrovyx

Detect cloud misconfigurations across AWS, GCP, and Azure environments.

3|1|Updated Jul 2, 2026

Search Tags:#security #aws #reconnaissance #cloud #pentesting #misconfiguration #ssrf

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-cloud-misconfig-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-cloud-misconfig
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-cloud-misconfig
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-cloud-misconfig-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the high-risk challenge of identifying exposed cloud resources and misconfigurations that could lead to data breaches or unauthorized access.

Core Features & Use Cases

Automated Reconnaissance: Detects public S3 buckets, exposed CloudFront origins, and accessible metadata services via SSRF.
Credential & Secret Extraction: Scans JS bundles for leaked identity pool IDs and guest role ARNs.
Validation Workflow: Provides a safe, local-verification toolchain using LocalStack to confirm findings without impacting production environments.

Quick Start

Initiate a cloud misconfiguration scan against the target domain by providing the hostname to the hunt-cloud-misconfig skill.

Frequently Asked Questions about hunt-cloud-misconfig

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan for exposed S3 buckets and cloud misconfigurations during a pentest?▼

You can scan for exposed S3 buckets and cloud misconfigurations by running automated reconnaissance against a target hostname. This detects public storage, exposed CloudFront origins, and accessible metadata services to identify unauthorized access vectors.

Can I detect leaked IAM credentials and identity pool IDs in JavaScript bundles?▼

Yes, you can detect leaked IAM credentials by scanning JavaScript bundles for extracted identity pool IDs and guest role ARNs. This identifies exposed cloud identity secrets that could enable unauthorized infrastructure access.

Does this cloud reconnaissance approach work across AWS, GCP, and Azure environments?▼

Yes, this cloud reconnaissance applies to security assessments across AWS, GCP, and Azure environments. It identifies unauthorized access vectors by validating misconfigurations like public storage buckets and exposed metadata services.

How do I safely validate SSRF and cloud metadata service exposure findings?▼

You safely validate SSRF and metadata service findings using a local Docker-based simulation with LocalStack. This verification toolchain confirms misconfigurations without impacting or interacting with production cloud environments.

What do I need to run an automated cloud misconfiguration scan?▼

You need network connectivity for remote reconnaissance and a local Docker environment to run LocalStack for safe verification. Provide the target hostname to initiate the scan and detect exposed cloud infrastructure resources.