recon-cloud-assets

To find exposed cloud storage buckets during a pentest, this skill performs passive discovery using CT logs and search dorks, then validates permissions with unsigned API checks for S3, Azure Blob, and GCP storage.

You can check S3 bucket permissions without authentication by performing safe, unsigned API requests to determine if storage buckets are publicly accessible or misconfigured, ensuring assessments stay within authorized scope.

The best way to enumerate cloud subdomains and CDN endpoints is using passive discovery techniques like CT logs, which identify cloud-hosted infrastructure while enforcing strict safety gates and rate limits.

You need awscli, nuclei, and jq installed to validate cloud asset exposures, as the skill relies on these dependencies to execute unsigned API checks and run nuclei templates for evidence-based findings.

To generate structured reports for misconfigured cloud assets, the skill automates reporting output to highlight sensitive file patterns and permission risks discovered during the authorized security assessment.

Limitations when running active security validation include strict adherence to scope-gated boundaries, rate-limited execution, and the exclusive use of unsigned API requests to prevent unauthorized data modification.