agentsclimarketplace

Detecting aws iam privilege escalation

Skill autohandai/community-skills/detecting-aws-iam-privilege-escalation

A collection of curated, useful, and safe skills for Autohand Code CLI Agent

Install
npx -y skills add autohandai/community-skills --skill detecting-aws-iam-privilege-escalation

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 9 stars9 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

1.9 KB, as published. Nobody here has run it

Detecting AWS IAM Privilege Escalation

Overview

This skill uses boto3 and Cloudsplaining-style analysis to identify IAM privilege escalation paths in AWS accounts. It downloads the account authorization details, analyzes each policy for dangerous permission combinations (iam:PassRole + lambda:CreateFunction, iam:CreatePolicyVersion, sts:AssumeRole), and flags policies that violate least-privilege principles.

Prerequisites

  • Python 3.8+ with boto3 library
  • AWS credentials with IAM read-only access (iam:GetAccountAuthorizationDetails)
  • Optional: cloudsplaining Python package for HTML report generation

Steps

  1. Download IAM Authorization Details — Call iam:GetAccountAuthorizationDetails to retrieve all users, groups, roles, and policies
  2. Analyze Policies for Privilege Escalation — Check each policy for known escalation permission combinations
  3. Identify Wildcard Resource Policies — Flag policies using Resource: "*" with dangerous actions
  4. Map Principal-to-Policy Relationships — Build a graph of which principals can access which escalation paths
  5. Score and Prioritize Findings — Rank findings by severity based on escalation vector type
  6. Generate Report — Produce structured JSON report with remediation guidance

Expected Output

  • JSON report of privilege escalation findings with severity scores
  • List of dangerous permission combinations per principal
  • Wildcard resource policy audit results
  • Remediation recommendations for each finding

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.