# Cloud/K8s Security Skills: When and How to Use Them in Authorized Engagements

> Master cloud K8s security skills for authorized engagements. Learn to leverage them for cloud metadata, IAM, container escape, and K8s RBAC testing effectively and ethically.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-08

---

**Use the cloud-k8s skill exclusively for authorized penetration testing engagements targeting cloud metadata services, IAM misconfigurations, container escape vectors, and Kubernetes RBAC controls, ensuring you never perform unauthorized scanning of other tenants or blind Internet-wide reconnaissance.**

The `cloud-k8s` skill in the `zhaoxuya520/reverse-skill` repository defines a disciplined, authorized workflow for assessing cloud platform and Kubernetes cluster security. Designed for engagements with explicit permission to interact with cloud resources, this skill provides concrete checklist items and command sequences for evaluating AWS, GCP, and Azure environments alongside containerized workloads. Understanding when to deploy these **cloud/K8s security skills** ensures compliance with the repository's strict routing constraints while delivering comprehensive security assessments.

## Architecture of the Cloud/K8s Security Skill

The skill definition in [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md) structures the assessment methodology through five integrated components. The **Skill Definition** (lines 1-24) declares high-level objectives including metadata SSRF detection, IAM misconfiguration analysis, container escape path identification, and RBAC review. The **Workflow Phases** (lines 26-71) establish four progressive assessment stages, while the **Toolchain** section (lines 73-81) enumerates required binaries such as `kubectl`, `trivy`, `kube-bench`, `pacu`, and `scoutsuite`. The **Routing Context** (lines 89-94) defines upstream and downstream relationships and explicitly mandates "must-not" constraints to prevent unauthorized tenant scanning, as enforced by [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md).

## When to Apply Cloud and Kubernetes Security Skills

Deploy the cloud-k8s skill when your engagement scope explicitly includes the following attack surfaces:

- **Cloud metadata SSRF** – The target can reach provider metadata services (e.g., `169.254.169.254` on AWS) and you need to assess IMDS v1/v2 exploitation paths.
- **IAM and storage misconfigurations** – You are authorized to evaluate privilege escalation via overly permissive roles, public S3 buckets, or misconfigured security groups.
- **Container escape assessments** – The scope includes evaluating Docker or containerd configurations for privileged mounts, host networking, or dangerous capability abuses like `SYS_ADMIN`.
- **Kubernetes control plane review** – You need to audit RBAC bindings, ServiceAccount token exposure, admission webhooks, and pod security policies.
- **Supply-chain correlation** – When container image vulnerabilities must be linked with broader supply-chain security assessments.

If the target is a **plain web application** without cloud-specific resources, the repository routes you to the `pentest-tools/` skill instead, as documented in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md).

## The Four-Phase Assessment Workflow

The [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file organizes assessments into four sequential phases, each with concrete checklist items and required commands.

### Phase 1 – Identity & Scope

Before executing any tests, verify your authorization context and target boundaries:

```text

# Identify the current identity type

□ Current identity: AWS AccessKey/SecretKey, GCP Service Account, Azure AD token, or K8s ServiceAccount?
□ Scope: single account / single cluster / single namespace
□ Network profile: authorized_target_only

```

This phase ensures compliance with the routing rules that prohibit cross-tenant scanning.

### Phase 2 – Cloud Control Plane

Enumerate cloud resources using provider-specific CLIs, focusing on identity validation and resource exposure:

```bash

# AWS example – must be run from an authorized account

aws sts get-caller-identity
aws s3 ls                # Lists buckets you can access

aws ec2 describe-instances   # Enumerate instances if allowed

# GCP example

gcloud auth list
gcloud compute instances list

# Azure example

az account show
az storage account list

```

According to lines 44-47 of [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md), prioritize detecting public buckets, querying IMDS for SSRF opportunities, and enumerating `PassRole` assumption paths.

### Phase 3 – Container Security

Evaluate the container runtime environment for escape vectors and image vulnerabilities:

```text

# Examine the host environment (container runtime)

□ Is the container running privileged?  
□ Are hostPath or hostNetwork mounts present?  
□ Does the container have dangerous capabilities (e.g., SYS_ADMIN)?  

```

Execute image scanning with:

```bash

# Image vulnerability scan (requires Trivy)

trivy image myregistry/myapp:latest

```

As noted in lines 52-56, document host-bound paths that could enable escape and correlate CVE findings with the supply-chain skill.

### Phase 4 – Kubernetes Cluster Assessment

Probe the Kubernetes API for RBAC misconfigurations and exposed secrets:

```bash

# RBAC enumeration

kubectl auth can-i --list
kubectl get pods,secrets,svc -A
kubectl get clusterrolebindings

# ServiceAccount token inspection

kubectl describe secret $(kubectl get secret -n <namespace> -o name | grep default-token)

# Admission webhook & network policy check

kubectl get validatingwebhookconfiguration
kubectl get networkpolicy -A

```

Lines 66-70 of the skill definition mandate verifying SA token mounting permissions, detecting dangerous admission webhooks, and confirming etcd or dashboard exposure alongside default-allow network policies.

## Required Toolchain and Setup

The workflow requires specific binaries enumerated in [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md) (lines 73-81):

- **kubectl** – For Kubernetes API interaction and RBAC enumeration
- **trivy** – For container image vulnerability scanning
- **kube-bench** or **kubeaudit** – For CIS benchmark auditing
- **pacu** or **scoutsuite** – For AWS and multi-cloud exploitation frameworks
- **nuclei** – For targeted vulnerability scanning

Some tools require manual installation, while others bootstrap automatically depending on the engagement environment.

## Summary

- The **cloud-k8s** skill provides a structured, four-phase workflow for authorized cloud and Kubernetes penetration testing defined in [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md).
- Use this skill exclusively when engaging with cloud metadata services, IAM configurations, container runtimes, and Kubernetes control planes with documented permission.
- The methodology strictly prohibits unauthorized scanning of other tenants or blind Internet-wide reconnaissance as enforced by [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md).
- Required tools include `kubectl`, `trivy`, `kube-bench`, and cloud-specific frameworks like `pacu` or `scoutsuite`.
- For non-cloud web applications, the repository routes assessments to the `pentest-tools/` skill instead.

## Frequently Asked Questions

### What is the difference between the cloud-k8s skill and general penetration testing tools?

The cloud-k8s skill targets infrastructure-layer assessments of cloud provider APIs, container runtimes, and Kubernetes clusters, while the `pentest-tools/` skill handles application-layer testing for standard web applications. According to [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), you must use cloud-k8s when the scope includes AWS, GCP, Azure, or Kubernetes resources, and pentest-tools for standalone web applications without cloud dependencies.

### Which binaries are required to execute the cloud-k8s workflow?

The toolchain specified in [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md) requires `kubectl` for cluster interaction, `trivy` for image scanning, `kube-bench` or `kubeaudit` for compliance checking, and cloud frameworks like `pacu` or `scoutsuite` for AWS and multi-cloud assessments. The skill documentation indicates whether each tool requires manual installation or automatic bootstrapping.

### Can I use this skill for blind scanning of public cloud endpoints?

No. The [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) file and routing context in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) (lines 89-94) explicitly prohibit unauthorized scanning and mandate "authorized_target_only" network profiles. This skill is designed for controlled penetration testing engagements with explicit permission, not for Internet-wide reconnaissance or testing resources belonging to other tenants.

### How does the skill handle container image vulnerability assessment?

Phase 3 of the workflow integrates `trivy` to scan container images for CVEs, as shown in the command `trivy image myregistry/myapp:latest`. The skill correlates these findings with host configuration reviews (privileged modes, hostPath mounts) to identify complete escape chains, and links results to the supply-chain security skill when assessing broader software dependencies.