# Pacu

> Use for AWS-focused adversary simulation and control-plane validation during authorized pentests. Trigger on approved AWS privilege path review, service-specific assessment, and understanding what an authorized AWS principal can realistically do.

- Skill: `timsonner/pacu` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/pacu`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/pacu/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/pacu

---


# Pacu

## Purpose

Use this skill for AWS-focused adversary simulation only when the rules of engagement explicitly allow deeper control-plane validation beyond basic read-only inspection.

## Phase Fit

- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to assess realistic AWS privilege paths or service-specific risk.
- Need a module-driven workflow for an approved AWS objective.
- Need a repeatable retest for an AWS exposure path.

## Avoid When

- AWS scope or module impact is unclear.
- The engagement only permits passive or read-only validation.

## Inputs

- Approved AWS account and profile
- Explicitly allowed Pacu modules or objectives
- Stop conditions and evidence boundaries

## Procedure

1. Confirm the exact AWS scope and allowed objectives.
2. Use only the minimum module set needed for the question.
3. Prefer read-oriented validation where possible.
4. Stop once the approved proof standard is met.
5. Preserve the exact module path and profile context for retest.

## Command Syntax

Launch syntax is stable, while module execution happens inside the framework.

```bash
# Launch Pacu
pacu

# Inside the Pacu console:
import_keys --profile pentest      # Import AWS credentials
run iam__enum_users_roles_policies  # Enumerate IAM
run ec2__enum                       # Enumerate EC2 instances
run s3__bucket_finder               # Find S3 buckets
run iam__privesc_scan               # Scan for privilege escalation paths
run secretsmanager__enum            # Enumerate Secrets Manager
data                                # View all collected data
```

## Evidence to Capture

- What the approved AWS principal could access or do
- Exact modules and account scope used
- Minimal proof path needed for remediation

## Safety Boundaries

- Use only approved modules and approved AWS scope.
- Do not escalate to destructive or persistence-oriented actions without explicit written approval.