Cloud Setup Agent Skill

> Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.

1k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

546

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/elastic/agent-skills --skill cloud-setup

The instruction itself

11 sections, as written by the author

Cloud Environment Setup

Configure Elastic Cloud authentication and preferences. All other cloud/* skills depend on this setup.

Workflow

Setup Progress:
- [ ] Step 1: Verify API key
- [ ] Step 2: Set defaults
- [ ] Step 3: Validate connection

Step 1: Verify API key

Check whether EC_API_KEY is already set:

echo "${EC_API_KEY:?Not set}"

If not set, instruct the user to set it. Never ask the user to paste an API key into the chat — secrets must not

appear in conversation history.

If the user indicates they do not have an Elastic Cloud account yet, propose starting a free trial at

Elastic Cloud free trial. The trial provides 14 days of full access to Elastic

Cloud Serverless with no credit card required. Once the user has registered and logged in, proceed with API key

generation below.

Direct the user to:

Generate a key at Elastic Cloud API keys. Only Organization owners can

create and manage Cloud API keys.

When creating this key, include Project Admin privileges or higher (Org Owner) so it can create and manage

serverless projects.

Create a .env file in the project root (recommended — works in sandboxed agent shells):

EC_API_KEY=your-api-key

All cloud/* scripts auto-load .env from the working directory — no manual sourcing needed.

Alternatively, export directly in the terminal:

export EC_API_KEY="your-api-key"

Terminal exports might not be visible to sandboxed agents running in a separate shell session. Prefer the .env file

when working with an agent.

Remind the user that storing secrets in local files is acceptable for development, but for production or shared

environments, use a centralized secrets manager (for example, HashiCorp Vault, AWS Secrets Manager, 1Password CLI) to

avoid secrets sprawl.

Step 2: Set defaults

Export the base URL and default region:

export EC_BASE_URL="https://api.elastic-cloud.com"
export EC_REGION="gcp-us-central1"

Ask the user if they want a different region. To list available regions:

curl -s -H "Authorization: ApiKey ${EC_API_KEY}" \
  "${EC_BASE_URL}/api/v1/serverless/regions" | python3 -m json.tool

Step 3: Validate connection

Confirm the API key works by calling the regions endpoint:

curl -sf -H "Authorization: ApiKey ${EC_API_KEY}" \
  "${EC_BASE_URL}/api/v1/serverless/regions" > /dev/null && echo "Authenticated." || echo "Authentication failed."

If validation fails, check:

The API key is valid and not expired
Network connectivity to api.elastic-cloud.com

Examples

First-time setup

User: set up my cloud environment
Agent: Check if EC_API_KEY is set in your terminal. If not, generate a key at
       https://cloud.elastic.co/account/keys and run:
       export EC_API_KEY="your-key"
       Then confirm and I'll validate the connection.

Setup with custom region

User: set up cloud with eu region
Agent: [runs setup, sets EC_REGION to user's preferred EU region]

Guidelines

Never receive, echo, or log API keys, passwords, or any credentials in the chat. Instruct the user to manage secrets

in their terminal or using files directly.

Always validate the connection after setting the key.
Default region is gcp-us-central1 — only change if the user requests a different region.
This skill is a prerequisite. Other cloud skills should refer here when EC_API_KEY is missing.

Environment variables

| Variable | Required | Description |

| ------------- | -------- | ------------------------------------------------------------- |

| EC_API_KEY | Yes | Elastic Cloud API key |

| EC_BASE_URL | No | Cloud API base URL (default: https://api.elastic-cloud.com) |

| EC_REGION | No | Default region (default: gcp-us-central1) |

Troubleshooting

| Problem | Fix |

| -------------------- | -------------------------------------------------- |

| 401 Unauthorized | API key is invalid or expired — generate a new one |

| connection refused | Check network access to api.elastic-cloud.com |

Other skills for the same job

different authors, same section of the catalogue

Fhir Developer Skill

by anthropics

vendor ×1

> FHIR REST endpoints (Patient, Observation, Encounter, Condition, MedicationRequest), (2) Validating FHIR resources and returning proper HTTP status codes and error responses, (3) Implementing SMART on FHIR authorization and OAuth scopes, (4) Working with Bundles, transactions, batch operations, or search pagination. Covers FHIR R4 resource structures, required fields, value sets (status codes, gender, intent), coding systems (LOINC, SNOMED, RxNorm, ICD-10), and OperationOutcome error handling.

Interact with ClawDirect, a directory of social web experiences for AI agents. Use this skill to browse the directory, like entries, or add new sites. Requires ATXP authentication for MCP tool calls. Triggers: browsing agent-oriented websites, discovering social platforms for agents, liking/voting on directory entries, or submitting new agent-facing sites to ClawDirect.

Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable behaviors, self-reflection quality gates (1-10 scoring, ≥8 threshold), and a self-learning system with lesson/memory governance for security analysis agents.

4k tokens

Use Native Credential Proxy

by nanocoai

Opt out of the OneCLI gateway and supply Anthropic credentials from .env instead. For users who want simple .env-based credential management without the OneCLI agent vault. Reads the API key or OAuth token from .env and injects it into the container's API requests.

Cross-product Zoom reference skill. Use after the workflow is clear when you need shared platform guidance, app-model comparisons, authentication context, scopes, marketplace considerations, or API-vs-MCP routing.

>- Static source-code vulnerability scan. Reads a target directory (and THREAT_MODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in <dir>", or as the step between /threat-model and /triage.

3k tokens

Hunt Session

by elementalsouls

Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB confirmation for theft chains. Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO).

> Use this skill when the user is doing hands-on DOCA AES-GCM work on a BlueField DPU or ConnectX NIC — configuring `doca_aes_gcm_task_encrypt` / `_task_decrypt`, querying `doca_aes_gcm_cap_*` for per-key-type (only `DOCA_AES_GCM_KEY_128` / `_256` — AES-192 not supported) and per-task support, sizing plaintext against the max-buf cap, setting source / destination mmap permissions, validating with a NIST GCMVS or RFC 5288 vector, or debugging DOCA_ERROR_* including the security-critical tag-verification-failed outcome on decrypt. Trigger even when the user does not explicitly mention "DOCA AES-GCM" or IO_FAILED", "auth tag isn't verifying", "NOT_PERMITTED on my encrypt buffer", "is AES-192-GCM on this BlueField" (no), or "encrypted record came back tampered". Refuse and route elsewhere for non-GCM AES modes (CBC / CTR / XTS — CPU OpenSSL), key management (KMS / HSM / rotation), SHA (doca-sha), or general AEAD background.

24k tokens

How to use it

Copy the folder

Take elastic/cloud-setup from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.