How do I install the Recon Cloud Assets skill?

Run npx skillmds@latest add noorqureshi/recon-cloud-assets in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Recon Cloud Assets safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Recon Cloud Assets?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Recon Cloud Assets free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Recon Cloud Assets?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Recon Cloud Assets by noorqureshi — Agent Skill

Name: Recon Cloud Assets
Author: NoorQureshi

Recon Cloud Assets

Discover an organization's cloud footprint — buckets, blobs, apps, IP ranges, and services across AWS/GCP/Azure. Load during recon on a company target, on "cloud recon", finding storage/assets, or before cloud testing. Signals: an org name/domain in scope, assets on cloud CDNs, wildcard program.

NoorQureshi 422417a 2.0 KB Updated Sep 17, 2026

File contents

Cloud asset discovery

When it applies

Recon on an org where a lot of surface lives in the cloud. Mapping the cloud footprint surfaces storage exposure, forgotten apps, and IP ranges that feed the cloud-specific skills.

Why it works

Cloud resources use predictable naming and public namespaces (S3 bucket names are global; app services use *.azurewebsites.net, *.appspot.com, etc.). Permuting the org name across providers reveals assets that aren't linked from the main site.

Method

Permutation sweep: cloud_enum -k <company> -k <company>-prod -k <brand> to check AWS S3, Azure blobs/apps, and GCP buckets/apps for names derived from the org.
From existing assets: resolve subdomains/CNAMEs (→ recon-subdomain-enum, recon-dns-analysis) for cloud endpoints (*.s3.amazonaws.com, *.blob.core.windows.net, *.cloudfront.net).
IP ranges / ASN: find the org's ASN and cloud IP ranges; identify origin IPs behind CDNs.
Storage exposure: feed discovered buckets/containers to cloud-s3-exposure (list/read/write test).
Certificate transparency + favicon/Shodan (→ recon-osint) to catch cloud-hosted apps.

Gotchas

Stay in scope — cloud recon surfaces third-party SaaS and unrelated tenants; verify ownership.
Shared CDNs (Cloudflare/CloudFront) are not the org's infra — don't attack the CDN; find origin.
Anonymous bucket testing must be minimal (list/read a marker) — see cloud-s3-exposure for care.

Verify success

A map of in-scope cloud assets (buckets, apps, IP ranges) with any exposed storage flagged for follow-up by the cloud skills.

References

cloud_enum; s3scanner; "cloud recon" methodology; provider public-namespace docs.

---name: recon-cloud-assetsdescription: Discover an organization's cloud footprint — buckets, blobs, apps, IP ranges, and services across AWS/GCP/Azure. Load during recon on a company target, on "cloud recon", finding storage/assets, or before cloud testing. Signals: an org name/domain in scope, assets on cloud CDNs, wildcard program.---# Cloud asset discovery## When it appliesRecon on an org where a lot of surface lives in the cloud. Mapping the cloud footprint surfacesstorage exposure, forgotten apps, and IP ranges that feed the cloud-specific skills.## Why it worksCloud resources use predictable naming and public namespaces (S3 bucket names are global; appservices use `*.azurewebsites.net`, `*.appspot.com`, etc.). Permuting the org name across providersreveals assets that aren't linked from the main site.## Method1. **Permutation sweep**: `cloud_enum -k <company> -k <company>-prod -k <brand>` to check AWS S3, Azure blobs/apps, and GCP buckets/apps for names derived from the org.2. **From existing assets**: resolve subdomains/CNAMEs (→ `recon-subdomain-enum`, `recon-dns-analysis`) for cloud endpoints (`*.s3.amazonaws.com`, `*.blob.core.windows.net`, `*.cloudfront.net`).3. **IP ranges / ASN**: find the org's ASN and cloud IP ranges; identify origin IPs behind CDNs.4. **Storage exposure**: feed discovered buckets/containers to `cloud-s3-exposure` (list/read/write test).5. **Certificate transparency + favicon/Shodan** (→ `recon-osint`) to catch cloud-hosted apps.## Gotchas- Stay in scope — cloud recon surfaces third-party SaaS and unrelated tenants; verify ownership.- Shared CDNs (Cloudflare/CloudFront) are not the org's infra — don't attack the CDN; find origin.- Anonymous bucket testing must be minimal (list/read a marker) — see `cloud-s3-exposure` for care.## Verify successA map of in-scope cloud assets (buckets, apps, IP ranges) with any exposed storage flagged forfollow-up by the cloud skills.## Referencescloud_enum; s3scanner; "cloud recon" methodology; provider public-namespace docs.

Frequently asked questions