analysis-and-reporting
Endpoint interest scoring, mobile app ownership confidence, attack-path hint patterns, a severity decision matrix, sector…
@ap6packInstall SkillSecurity
Skill
/cloud-and-infra
Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon.
Claude Code
$ npx -y skills add Ap6pack/outrider-recon --skill cloud-and-infra --agent claude-code
Codex
$ npx skills add Ap6pack/outrider-recon --skill cloud-and-infra -a codex -y
Cursor
$ npx skills add Ap6pack/outrider-recon --skill cloud-and-infra -a cursor -y
Gemini CLI
$ npx skills add Ap6pack/outrider-recon --skill cloud-and-infra -a gemini-cli -y
GitHub Copilot
$ npx skills add Ap6pack/outrider-recon --skill cloud-and-infra -a github-copilot -y
OpenCode
$ npx skills add Ap6pack/outrider-recon --skill cloud-and-infra -a opencode -y
Windsurf
$ npx skills add Ap6pack/outrider-recon --skill cloud-and-infra -a windsurf -y
SKILL.md
cloud-and-infra.SKILL.mdname: cloud-and-infra
description: "Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon."
when_to_use: "Use for cloud-native service fingerprinting (Lambda function URLs, Cloud Run), Kubernetes/container exposure (kubelet, etcd, Docker API, container registries), CI/CD platform exposure (Jenkins, self-hosted GitLab, GitHub Actions secrets, Argo CD), TLS deep audits (JA3/JA4), or favicon-hash pivoting."
Cloud & Infrastructure OSINT
> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only.
---
BEHAVIORAL CONTRACT
**When triggered:** Cloud-native service fingerprinting, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, or container registry leak hunting is needed.
**Execute:**
1. For each discovered subdomain/IP, match against cloud-native URL patterns (§1). Classify provider and service type. 2. Check public-vs-auth-required on each cloud function endpoint (HEAD/GET). 3. For K8s/container exposure: probe ports from §2 table (Docker 2375/2376, kubelet 10250, etcd 2379, K8s API 6443/8443). Anonymous access = CRITICAL. 4. Check CI/CD platforms (§3) for unauthenticated access. 5. Run TLS deep audit (§4) on every HTTPS endpoint in scope. 6. Check public container registries (§2) for target-owned images. 7. For each finding, emit per `osint-methodology` §3 schema.
**Output:** Infrastructure findings with provider, service type, auth posture, severity. All per `osint-methodology` §3 schema.
**Severity rules:** Inline per section tables. Docker API unencrypted = CRITICAL. Open kubelet = CRITICAL. Open etcd = CRITICAL. K8s API anonymous = HIGH. TLS 1.0/1.1 = MEDIUM.
**Gating rules:** Active port probing is HIGH detectability — confirm authorization. Container image pulls generate logs — note detectability.
**Chain to:** Feed discovered cloud endpoints to `web-surface` for HTTP checks. Feed K8s findings to `analysis-and-reporting` for attack-path hints. For ASN/BGP lookups, use `recon-asset-discovery`.
---
1. Cloud-Native Service Fingerprints
| Provider | URL pattern | Notes | | ----------------------------- | -------------------------------------- | --------------------------------------------------------------------- | | **AWS Lambda Function URL** | `*.lambda-url.<region>.on.aws` | Direct invocation; check IAM auth posture | | **AWS App Runner** | `*.<region>.awsapprunner.com` | Managed container | | **AWS API Gateway** | `*.execute-api.<region>.amazonaws.com` | REST/HTTP/WebSocket; check authorizer | | **AWS CloudFront** | `d{14}\.cloudfront\.net` | Distribution; find origin via `docs/methods/cdn-bypass-techniques.md` | | **AWS ALB / ELB** | `*.elb.<region>.amazonaws.com` | Behind = EC2 / ECS | | **AWS Amplify** | `*.amplifyapp.com` | Static + Lambda backend | | **Google Cloud Run** | `*.run.app` (and `*.<region>.run.app`) | Check public-vs-IAM auth | | **Google Cloud Functions** | `*.cloudfunctions.net` | Serverless | | **Google App Engine** | `*.appspot.com` | Older serverless | | **Azure Functions** | `*.azurewebsites.net` | Function App; also App Service | | **Azure Container Apps** | `*.azurecontainerapps.io` | Containers | | **Vercel** | `*.vercel.app`, `*.now.sh` (legacy) | Frontend + serverless | | **Netlify** | `*.netlify.app`, `*.netlify.com` | Frontend + functions | | **Cloudflare Workers** | `*.workers.dev` | Edge functions | | **Cloudflare Pages** | `*.pages.dev` | Static + functions | | **Heroku** | `*.herokuapp.com` | Dynos | | **Render** | `*.onrender.com` | Container/static | | **Railway** | `*.railway.app` | App platform | | **DigitalOcean App Platform** | `*.ondigitalocean.app` | Static + container |
**Per-platform checks:**
- Confirm public vs auth-required (HEAD / GET).
- Check CORS posture.
- Lambda Function URLs / Cloud Run / Cloud Functions: anonymous invocation = HIGH finding.
- Static + functions hybrids (Vercel/Netlify): function paths usually `/api/*`; enumerate via JS extraction.
---
2. Container & Kubernetes Exposure
| Target | Port | Probe | Severity | | ---------------------------------------------- | -------------------- | -----------------------------------------------------------------------------------------------
Read more
name: cloud-and-infra description: "Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon." when_to_use: "Use for cloud-native service fingerprinting (Lambda function URLs, Cloud Run), Kubernetes/container exposure (kubelet, etcd, Docker API, container registries), CI/CD platform exposure (Jenkins, self-hosted GitLab, GitHub Actions secrets, Argo CD), TLS deep audits (JA3/JA4), or favicon-hash pivoting."
Cloud & Infrastructure OSINT
> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only.
---
BEHAVIORAL CONTRACT
**When triggered:** Cloud-native service fingerprinting, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, or container registry leak hunting is needed.
**Execute:**
1. For each discovered subdomain/IP, match against cloud-native URL patterns (§1). Classify provider and service type. 2. Check public-vs-auth-required on each cloud function endpoint (HEAD/GET). 3. For K8s/container exposure: probe ports from §2 table (Docker 2375/2376, kubelet 10250, etcd 2379, K8s API 6443/8443). Anonymous access = CRITICAL. 4. Check CI/CD platforms (§3) for unauthenticated access. 5. Run TLS deep audit (§4) on every HTTPS endpoint in scope. 6. Check public container registries (§2) for target-owned images. 7. For each finding, emit per `osint-methodology` §3 schema.
**Output:** Infrastructure findings with provider, service type, auth posture, severity. All per `osint-methodology` §3 schema.
**Severity rules:** Inline per section tables. Docker API unencrypted = CRITICAL. Open kubelet = CRITICAL. Open etcd = CRITICAL. K8s API anonymous = HIGH. TLS 1.0/1.1 = MEDIUM.
**Gating rules:** Active port probing is HIGH detectability — confirm authorization. Container image pulls generate logs — note detectability.
**Chain to:** Feed discovered cloud endpoints to `web-surface` for HTTP checks. Feed K8s findings to `analysis-and-reporting` for attack-path hints. For ASN/BGP lookups, use `recon-asset-discovery`.
---
1. Cloud-Native Service Fingerprints
| Provider | URL pattern | Notes | | ----------------------------- | -------------------------------------- | --------------------------------------------------------------------- | | **AWS Lambda Function URL** | `*.lambda-url.<region>.on.aws` | Direct invocation; check IAM auth posture | | **AWS App Runner** | `*.<region>.awsapprunner.com` | Managed container | | **AWS API Gateway** | `*.execute-api.<region>.amazonaws.com` | REST/HTTP/WebSocket; check authorizer | | **AWS CloudFront** | `d{14}\.cloudfront\.net` | Distribution; find origin via `docs/methods/cdn-bypass-techniques.md` | | **AWS ALB / ELB** | `*.elb.<region>.amazonaws.com` | Behind = EC2 / ECS | | **AWS Amplify** | `*.amplifyapp.com` | Static + Lambda backend | | **Google Cloud Run** | `*.run.app` (and `*.<region>.run.app`) | Check public-vs-IAM auth | | **Google Cloud Functions** | `*.cloudfunctions.net` | Serverless | | **Google App Engine** | `*.appspot.com` | Older serverless | | **Azure Functions** | `*.azurewebsites.net` | Function App; also App Service | | **Azure Container Apps** | `*.azurecontainerapps.io` | Containers | | **Vercel** | `*.vercel.app`, `*.now.sh` (legacy) | Frontend + serverless | | **Netlify** | `*.netlify.app`, `*.netlify.com` | Frontend + functions | | **Cloudflare Workers** | `*.workers.dev` | Edge functions | | **Cloudflare Pages** | `*.pages.dev` | Static + functions | | **Heroku** | `*.herokuapp.com` | Dynos | | **Render** | `*.onrender.com` | Container/static | | **Railway** | `*.railway.app` | App platform | | **DigitalOcean App Platform** | `*.ondigitalocean.app` | Static + container |
**Per-platform checks:**
- Confirm public vs auth-required (HEAD / GET).
- Check CORS posture.
- Lambda Function URLs / Cloud Run / Cloud Functions: anonymous invocation = HIGH finding.
- Static + functions hybrids (Vercel/Netlify): function paths usually `/api/*`; enumerate via JS extraction.
---
2. Container & Kubernetes Exposure
| Target | Port | Probe | Severity | | ---------------------------------------------- | -------------------- | -----------------------------------------------------------------------------------------------
Stats
15
Stars
0
Forks
Maintained
Maintenance
Python
Language
Last commit
Created
Ships withoutrider-recon
Claude-native, governed offensive-OSINT and external attack-surface platform for authorized security teams. Outrider is the governed front half of the offensive workflow.
1511 skills1 MCP
Stars on GitHub
Momentum
- stars in total
- 15
Other skills on outrider-recon.
@ap6packInstall Skillidentity-fabric
Concrete endpoints, probes, and enumeration techniques for identity provider fingerprinting and auth surface mapping. Covers…
@ap6packInstall Skilloffensive-osint
Router for the Offensive OSINT arsenal. Dispatches to focused sub-skills by task type. Covers the full external red-team surface:…
@ap6packInstall Skillosint-methodology
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the staged…
@ap6packInstall Skillpeople-breach-intel
Breach data lookup, HudsonRock infostealer intel, email-pattern inference, email harvest, Slack/Discord discovery, package…
@ap6packInstall Skillpost-discovery
Post-credential enumeration workflows for validated live keys — AWS IAM enum, GitHub PAT scope/repo enum, Slack workspace enum,…
@ap6packInstall SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about cloud-and-infra.
- Which coding agents can use cloud-and-infra?
- cloud-and-infra installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.