How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

cloud-iam-deep - Skill - OpenSmartRoute

Name: cloud-iam-deep
Author: sickn33

Imported from sickn33/agentic-awesome-skills (skills/cloud-iam-deep/SKILL.md). Install upstream with npx skills add sickn33/agentic-awesome-skills --skill cloud-iam-deep. Copyright stays with the author (MIT).

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

Ask the user to state the exact target URL, IP, account, or resource.

Ask the user to confirm written authorization and the permitted scope.

Show the exact command(s) and explain their expected effect.

Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

When to use

Trigger when:

A cloud credential surfaces (key, secret, token, JSON file)
SSRF chain reaches IMDS / metadata endpoint
APK / git-leak reveals embedded cloud key
Recon shows public S3/GCS/Azure-blob with permissions you can verify
A Kubernetes API or service-account token is exposed
Post-RCE on a cloud-hosted instance — pivot to cloud control plane

Do NOT use for:

On-prem-only environments (use AD attack skills — but those are out of scope per external-only boundary)
Web2 vulns that happen to be on AWS — use the relevant hunt-* skill

Credential identification (first 60 seconds)

# AWS access key patterns
AKIA[0-9A-Z]{16}                # IAM user access key (long-term)
ASIA[0-9A-Z]{16}                # STS temporary credential
AGPA[0-9A-Z]{16}                # IAM group
AIDA[0-9A-Z]{16}                # IAM user (user-id)
AROA[0-9A-Z]{16}                # IAM role
ANPA[0-9A-Z]{16}                # Managed policy

# AWS secret pattern (40-char base64-ish — context required)
[A-Za-z0-9/+=]{40}              # AWS secret access key

# Azure
AccountKey=[A-Za-z0-9+/=]{86}   # Storage account key
client_secret pattern + UUID    # Azure AD app credential

# GCP service account JSON
{
  "type": "service_account",
  "project_id": "...",
  "private_key_id": "...",
  "private_key": "[REDACTED private-key]

Install cloud-iam-deep and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "sickn33-agentic-awesome-skills-cloud-iam-deep", "kind": "skill", "name": "cloud-iam-deep", "description": "Cloud IAM red-team attack chain across AWS, Azure, GCP", "publisher": "sickn33", "version": "1.0.0", "capabilities": { "domains": [ "coding", "math" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Cloud IAM red-team attack chain across AWS, Azure, GCP" ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/sickn33/agentic-awesome-skills", "path": "skills/cloud-iam-deep/SKILL.md", "ref": "HEAD", "url": "https://github.com/sickn33/agentic-awesome-skills/blob/HEAD/skills/cloud-iam-deep/SKILL.md", "key": "sickn33/agentic-awesome-skills/skills/cloud-iam-deep/SKILL.md" }, "compatibility": "Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.", "license": "MIT" }, "instructions": "> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show th", "cost": { "context_tokens": 555 } }

cloud-iam-deep

About

When to use

Credential identification (first 60 seconds)

Install cloud-iam-deep and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Use it

Manifest

Reviews