skills.rest
baiqigo
baiqigoCOMMUNITY
Explore all skills by this author →
GitHub

hunt-iac-secret-exposure

Validates publicly exposed Terraform state, IaC manifests, and deployment configs without using discovered credentials.

10|3|Updated Aug 10, 2026
Search Tags:#terraform#iac#security assessment#cloud misconfiguration#state file#evidence-gated#secret exposure
One-click install
npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-iac-secret-exposure-baiqigo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-iac-secret-exposure
Source: https://github.com/baiqigo/baiqi-redteam-lab/tree/main/.agents/skills/hunt-iac-secret-exposure
Command: npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-iac-secret-exposure-baiqigo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams need to confirm whether publicly accessible Terraform state files, IaC manifests, and deployment artifacts actually expose sensitive infrastructure metadata, without touching the credentials inside or violating engagement scope. ## Core Features & Use Cases - Evidence-Gated Validation: Follows a fixed baseline → single-variable probe → post-baseline → oracle → evidence workflow so every finding is reproducible and authorized. - Strict Safety Boundaries: Records only field locations and fingerprints of suspected secrets, never attempts logins, private state downloads, or cloud API calls. - False-Positive Filtering: Treats regex-matched strings, expired URLs, and third-party buckets as invalid, requiring reproducible public exposure of in-scope artifacts. - Use Case: During an authorized assessment, you discover a public URL resembling a Terraform state file. Use this Skill to verify it belongs to the target organization, confirm it exposes infrastructure metadata, and capture sanitized evidence for reporting. ## Quick Start Use $hunt-iac-secret-exposure to plan an evidence-gated, authorized validation of a publicly exposed Terraform state file within my approved scope.

Frequently Asked Questions about hunt-iac-secret-exposure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate an exposed Terraform state file safely?▼

Confirm the state file is currently public, in scope, and owned by the target organization, then perform read-only retrieval of approved canary configs. Record only field locations and fingerprints of suspected secrets, never attempting logins or cloud API calls.

What counts as proof of an IaC secret exposure finding?▼

A valid finding requires a reproducible public artifact in scope containing infrastructure or configuration metadata that should not be public, or organizational confirmation of an access control error. Regex-matched strings, expired URLs, and third-party buckets do not qualify.

Can I test whether exposed credentials actually work?▼

No. The workflow explicitly stops on any secret or token usage, private state downloads, cloud API calls, or cross-account resource access. Suspected credentials are documented only by field position and fingerprint.

When should IaC exposure findings be routed elsewhere?▼

Cloud storage misconfigurations route to a cloud-misconfig workflow, while pipeline or build-system exposures route to a CI/CD hunting workflow. This Skill covers only the IaC state, manifest, and deployment config exposure surface.

What are the limitations of black-box IaC exposure validation?▼

WAF blocks, timeouts, single anomalies, and scanner hits are all treated as inconclusive rather than findings. Validation also cannot proceed without authorization, defined scope, and an identity baseline, and stops on any irreversible side effects.

Related Skills

Explore More Software Engineering Skills→
hpsgdhpsgd

recon

Automate passive reconnaissance on a target domain using public sources.

Official
Advanced
dreadnodedreadnode
11

jxscout-findings

Create, retrieve, and list structured security research findings with deduplication and filtering.

Official
Intermediate
AcczdyAcczdy
2

conducting-external-reconnaissance-with-osint

Map an organization's external attack surface using passive OSINT techniques and structured JSON reports.

Community
Intermediate
Q16GQ16G
83

graybox-p0

Orchestrate gray-box testing by combining white-box candidate discovery with black-box request validation.

Community
Intermediate