Skill
analysis-and-reporting
Endpoint interest scoring (0–100), mobile app ownership confidence, attack-path hint patterns (35 templates), severity decision matrix (92 examples), sector…
@ap6packView SkillSecurity
Skill
/cloud-and-infra
Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon.
Install
$ npx -y skills add Ap6pack/outrider-recon --skill cloud-and-infra --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/cloud-and-infra
Context preview
The summary Claude sees to decide when to auto-load this skill.
Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon.
SKILL.md
cloud-and-infra.SKILL.mdname: cloud-and-infra
description: "Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon."
when_to_use: "Use for cloud-native service fingerprinting (Lambda function URLs, Cloud Run), Kubernetes/container exposure (kubelet, etcd, Docker API, container registries), CI/CD platform exposure (Jenkins, self-hosted GitLab, GitHub Actions secrets, Argo CD), TLS deep audits (JA3/JA4), or favicon-hash pivoting."
Cloud & Infrastructure OSINT
> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only.
---
BEHAVIORAL CONTRACT
**When triggered:** Cloud-native service fingerprinting, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, or container registry leak hunting is needed.
**Execute:**
1. For each discovered subdomain/IP, match against cloud-native URL patterns (§1). Classify provider and service type. 2. Check public-vs-auth-required on each cloud function endpoint (HEAD/GET). 3. For K8s/container exposure: probe ports from §2 table (Docker 2375/2376, kubelet 10250, etcd 2379, K8s API 6443/8443). Anonymous access = CRITICAL. 4. Check CI/CD platforms (§3) for unauthenticated access. 5. Run TLS deep audit (§4) on every HTTPS endpoint in scope. 6. Check public container registries (§2) for target-owned images. 7. For each finding, emit per `osint-methodology` §3 schema.
**Output:** Infrastructure findings with provider, service type, auth posture, severity. All per `osint-methodology` §3 schema.
**Severity rules:** Inline per section tables. Docker API unencrypted = CRITICAL. Open kubelet = CRITICAL. Open etcd = CRITICAL. K8s API anonymous = HIGH. TLS 1.0/1.1 = MEDIUM.
**Gating rules:** Active port probing is HIGH detectability — confirm authorization. Container image pulls generate logs — note detectability.
**Chain to:** Feed discovered cloud endpoints to `web-surface` for HTTP checks. Feed K8s findings to `analysis-and-reporting` for attack-path hints. For ASN/BGP lookups, use `recon-asset-discovery`.
---
1. Cloud-Native Service Fingerprints
| Provider | URL pattern | Notes | | ----------------------------- | -------------------------------------- | --------------------------------------------------------------------- | | **AWS Lambda Function URL** | `*.lambda-url.<region>.on.aws` | Direct invocation; check IAM auth posture | | **AWS App Runner** | `*.<region>.awsapprunner.com` | Managed container | | **AWS API Gateway** | `*.execute-api.<region>.amazonaws.com` | REST/HTTP/WebSocket; check authorizer | | **AWS CloudFront** | `d{14}\.cloudfront\.net` | Distribution; find origin via `docs/methods/cdn-bypass-techniques.md` | | **AWS ALB / ELB** | `*.elb.<region>.amazonaws.com` | Behind = EC2 / ECS | | **AWS Amplify** | `*.amplifyapp.com` | Static + Lambda backend | | **Google Cloud Run** | `*.run.app` (and `*.<region>.run.app`) | Check public-vs-IAM auth | | **Google Cloud Functions** | `*.cloudfunctions.net` | Serverless | | **Google App Engine** | `*.appspot.com` | Older serverless | | **Azure Functions** | `*.azurewebsites.net` | Function App; also App Service | | **Azure Container Apps** | `*.azurecontainerapps.io` | Containers | | **Vercel** | `*.vercel.app`, `*.now.sh` (legacy) | Frontend + serverless | | **Netlify** | `*.netlify.app`, `*.netlify.com` | Frontend + functions | | **Cloudflare Workers** | `*.workers.dev` | Edge functions | | **Cloudflare Pages** | `*.pages.dev` | Static + functions | | **Heroku** | `*.herokuapp.com` | Dynos | | **Render** | `*.onrender.com` | Container/static | | **Railway** | `*.railway.app` | App platform | | **DigitalOcean App Platform** | `*.ondigitalocean.app` | Static + container |
**Per-platform checks:**
- Confirm public vs auth-required (HEAD / GET).
- Check CORS posture.
- Lambda Function URLs / Cloud Run / Cloud Functions: anonymous invocation = HIGH finding.
- Static + functions hybrids (Vercel/Netlify): function paths usually `/api/*`; enumerate via JS extraction.
---
2. Container & Kubernetes Exposure
| Target | Port | Probe | Severity | | ---------------------------------------------- | -------------------- | -----------------------------------------------------------------------------------------------
Read more
name: cloud-and-infra description: "Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon." when_to_use: "Use for cloud-native service fingerprinting (Lambda function URLs, Cloud Run), Kubernetes/container exposure (kubelet, etcd, Docker API, container registries), CI/CD platform exposure (Jenkins, self-hosted GitLab, GitHub Actions secrets, Argo CD), TLS deep audits (JA3/JA4), or favicon-hash pivoting."
Cloud & Infrastructure OSINT
> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only.
---
BEHAVIORAL CONTRACT
**When triggered:** Cloud-native service fingerprinting, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, or container registry leak hunting is needed.
**Execute:**
1. For each discovered subdomain/IP, match against cloud-native URL patterns (§1). Classify provider and service type. 2. Check public-vs-auth-required on each cloud function endpoint (HEAD/GET). 3. For K8s/container exposure: probe ports from §2 table (Docker 2375/2376, kubelet 10250, etcd 2379, K8s API 6443/8443). Anonymous access = CRITICAL. 4. Check CI/CD platforms (§3) for unauthenticated access. 5. Run TLS deep audit (§4) on every HTTPS endpoint in scope. 6. Check public container registries (§2) for target-owned images. 7. For each finding, emit per `osint-methodology` §3 schema.
**Output:** Infrastructure findings with provider, service type, auth posture, severity. All per `osint-methodology` §3 schema.
**Severity rules:** Inline per section tables. Docker API unencrypted = CRITICAL. Open kubelet = CRITICAL. Open etcd = CRITICAL. K8s API anonymous = HIGH. TLS 1.0/1.1 = MEDIUM.
**Gating rules:** Active port probing is HIGH detectability — confirm authorization. Container image pulls generate logs — note detectability.
**Chain to:** Feed discovered cloud endpoints to `web-surface` for HTTP checks. Feed K8s findings to `analysis-and-reporting` for attack-path hints. For ASN/BGP lookups, use `recon-asset-discovery`.
---
1. Cloud-Native Service Fingerprints
| Provider | URL pattern | Notes | | ----------------------------- | -------------------------------------- | --------------------------------------------------------------------- | | **AWS Lambda Function URL** | `*.lambda-url.<region>.on.aws` | Direct invocation; check IAM auth posture | | **AWS App Runner** | `*.<region>.awsapprunner.com` | Managed container | | **AWS API Gateway** | `*.execute-api.<region>.amazonaws.com` | REST/HTTP/WebSocket; check authorizer | | **AWS CloudFront** | `d{14}\.cloudfront\.net` | Distribution; find origin via `docs/methods/cdn-bypass-techniques.md` | | **AWS ALB / ELB** | `*.elb.<region>.amazonaws.com` | Behind = EC2 / ECS | | **AWS Amplify** | `*.amplifyapp.com` | Static + Lambda backend | | **Google Cloud Run** | `*.run.app` (and `*.<region>.run.app`) | Check public-vs-IAM auth | | **Google Cloud Functions** | `*.cloudfunctions.net` | Serverless | | **Google App Engine** | `*.appspot.com` | Older serverless | | **Azure Functions** | `*.azurewebsites.net` | Function App; also App Service | | **Azure Container Apps** | `*.azurecontainerapps.io` | Containers | | **Vercel** | `*.vercel.app`, `*.now.sh` (legacy) | Frontend + serverless | | **Netlify** | `*.netlify.app`, `*.netlify.com` | Frontend + functions | | **Cloudflare Workers** | `*.workers.dev` | Edge functions | | **Cloudflare Pages** | `*.pages.dev` | Static + functions | | **Heroku** | `*.herokuapp.com` | Dynos | | **Render** | `*.onrender.com` | Container/static | | **Railway** | `*.railway.app` | App platform | | **DigitalOcean App Platform** | `*.ondigitalocean.app` | Static + container |
**Per-platform checks:**
- Confirm public vs auth-required (HEAD / GET).
- Check CORS posture.
- Lambda Function URLs / Cloud Run / Cloud Functions: anonymous invocation = HIGH finding.
- Static + functions hybrids (Vercel/Netlify): function paths usually `/api/*`; enumerate via JS extraction.
---
2. Container & Kubernetes Exposure
| Target | Port | Probe | Severity | | ---------------------------------------------- | -------------------- | -----------------------------------------------------------------------------------------------
Ships withoutrider-recon
Claude-native external recon and attack-surface management for authorized bug bounty, pentest, and security teams. Outrider turns public, read-only recon signals into prioritized, evidence-backed leads.
Get the whole plugin
Stats
13
Stars
0
Forks
Active
Maintenance
Python
Language
2d ago
Last commit
4mo ago
Created
Repo: Ap6pack/outrider-recon
Other skills on outrider-recon.
@ap6packView SkillSkill
identity-fabric
Concrete endpoints, probes, and enumeration techniques for identity provider fingerprinting and auth surface mapping. Covers Microsoft Entra (Azure AD), Okta,…
@ap6packView SkillSkill
offensive-osint
Router for the Offensive OSINT arsenal. Dispatches to focused sub-skills by task type. Covers the full external red-team surface: asset discovery, web…
@ap6packView SkillSkill
osint-methodology
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline, asset-graph…
@ap6packView SkillSkill
people-breach-intel
Breach data lookup, HudsonRock infostealer intel, email-pattern inference, email harvest, Slack/Discord discovery, package registry leaks, and vulnerability…
@ap6packView SkillSkill
post-discovery
Post-credential enumeration workflows for validated live keys — AWS IAM enum, GitHub PAT scope/repo enum, Slack workspace enum, JWT triage, Postman PMAK…
@ap6packView Skill