security-cloud-analyzer_skill

Overview

This skill evaluates cloud security posture across AWS, Azure, and GCP with focused checks for storage exposure, IAM policy issues, network segmentation, and compute configuration gaps. It produces prioritized findings with CVSS-style severity, cites applicable CIS or Well-Architected controls, and returns platform-specific remediation commands or IaC snippets. Outputs follow a strict JSON contract suitable for automation and reporting.

How this skill works

The analyzer inspects selected resource scopes (storage, iam, network, compute, or all) and runs a checklist of critical controls: public storage exposure, encryption at rest, overpermissive IAM policies, MFA enforcement, network segmentation, and compute hardening. For each finding it classifies severity, assigns a CVSS-like score, maps the control to CIS or Well-Architected guidance, and generates CLI or Terraform/ARM/CloudFormation remediation snippets. If account access is unavailable or inputs are ambiguous, it requests read-only credentials or architecture docs before proceeding.

When to use it

• Pre-production cloud security audit before deployment
• Compliance assessments against CIS Benchmarks or Well-Architected guidance
• Post-incident configuration review to identify exposure vectors
• Security validation during cloud migration or consolidation
• Preparing responses to third-party cloud security questionnaires

Best practices

• Specify cloud_platform and resource_scope explicitly; do not run with 'all' if you need a targeted scan
• Enable read-only account access or provide architecture diagrams when full account access is restricted
• Use the T1 token budget for urgent critical findings only and T2 for full remediation output
• Validate resource tagging and account boundaries to reduce false positives
• Avoid running this skill for real-time monitoring; use a CSPM for continuous checks

Example use cases

• Find and remediate publicly exposed S3/GCS/Azure Storage containers before a data migration
• Audit IAM policies to detect wildcard permissions and enforce MFA on privileged principals
• Validate disk encryption, instance metadata protection, and patch levels for compute fleets
• Check VPC/VNet segmentation, security group/NSG rules, and public IP exposures prior to a production launch
• Generate CLI commands or Terraform snippets to remediate failed CIS or Well-Architected controls