Back to marketplace

Cloud Security

Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps.

Development / Engineeringdevelopmentengineering
by AgentVoltv1.0.0Published 1y ago1 install
Free to sign up · every skill included with AgentVolt Pro

Before & after

Same prompt, same agent — the only difference is the skill.

Prompt“Audit our AWS infrastructure for security misconfigurations.”
Beforegeneric AI agent
You should review your AWS infrastructure for common security issues. This would involve checking things like IAM policies for overly permissive rules, S3 buckets for public exposure, security groups for open access, and encryption settings. You might also look at your Infrastructure as Code for security gaps. A comprehensive assessment would involve multiple checks across different AWS services. Do you have any specific concerns about your current setup, or should we start with a general review?
Afterwith Cloud Security
AWS SECURITY AUDIT FINDINGS REPORT

CRITICAL ISSUES (fix immediately):

1. S3 BUCKET EXPOSED (bucket-prod-assets-2026)
   Finding: Public read access enabled (ACL = public-read). Any internet user can list and download 14.2 GB of data including API keys in config files.
   MITRE ATT&CK: T1526 (cloud service discovery) → T1530 (data from cloud storage).
   Remediation: 1) Remove public ACL immediately. 2) Enable S3 Block Public Access (all four options). 3) Scan bucket contents for secrets (regex scan for "AKIA" prefixes). 4) Rotate any exposed credentials. Time: 1 hour.

2. RDS DATABASE SECURITY GROUP (rds-sg-prod)
   Finding: MySQL port 3306 open to 0.0.0.0/0 (entire internet). Brute-force attacks possible.
   MITRE ATT&CK: T1190 (exploit public-facing app) → T1110 (credential enumeration).
   Remediation: Restrict to application security group only (sg-app-layer). Remove 0.0.0.0/0 rule. Time: 15 minutes.

3. IAM ROLE OVER-PROVISIONED (lambda-execution-role)
   Finding: Lambda role has "s3:*" on resource "*". Allows read/write/delete ALL buckets (should be specific bucket + prefix). 14 Lambda functions inherit this role.
   MITRE ATT&CK: T1078 (valid accounts) → T1537 (transfer data to cloud account).
   Remediation: Create fine-grained role per Lambda (minimal principle). Specify exact bucket and object prefixes. Time: 3 hours.

HIGH-PRIORITY ISSUES (fix within 7 days):

4. CLOUDTRAIL NOT LOGGING (not enabled)
   Issue: API calls unaudited. Cannot investigate incidents. Compliance risk (SOC 2 requires audit trail).
   Remediation: Enable CloudTrail. Log to S3 with MFA-delete enabled. Time: 1 hour.

5. ROOT ACCOUNT MFA NOT ENFORCED
   Issue: Root AWS account has no MFA. Single compromised password = full AWS account takeover.
   Remediation: Enable MFA on root account (hardware key preferred). Never use root except account recovery. Time: 30 minutes.

MEDIUM-PRIORITY (30-day fix):

6. SECRETS STORED IN ENVIRONMENT VARIABLES
   Finding: Database passwords, API keys stored as plaintext in Lambda environment. Readable by any function with lambda:GetFunction permission.
   Remediation: Migrate to AWS Secrets Manager. Rotate credentials. Time: 2 days.

MITRE ATT&CK MAPPING (risk prioritization):
Initial Access (T1190): RDS exposed → Exploitation (T1110): Brute-force DB.
Privilege Escalation (T1078): Over-provisioned Lambda role → Lateral movement to S3.
Exfiltration (T1537): S3 public + Secrets in env vars = data leak vector.

30-DAY ROADMAP:
Week 1: Fix critical issues (S3, RDS, IAM). Enable CloudTrail. Week 2: Secrets rotation. Week 3: Implement VPC endpoint for S3 (blocks internet access). Week 4: Audit complete, retest all findings.

ESTIMATED EFFORT: 16 hours total. Cost to ignore: $480k potential breach recovery + compliance fine.

About this skill

name: cloud-security description: Use when Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps.

Cloud Security

Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture assessment with MITRE ATT&CK mapping.

What you get

  • Public GitHub repo (alirezarezvani/claude-skills)
  • the cloud-security skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.

Customize your output

  • Fork the repo and adapt the skill's instructions and references to your workflow.

Example output

Activates automatically when your request matches Cloud Security; chains with the other skills, agents, and commands in the collection.

Best for

Creators, builders, and teams using Claude Code.

SKILL.md preview

SKILL.md
---
name: cloud-security
description: Use this skill when assessing cloud infrastructure for misconfigurations, IAM privilege escalation paths, public storage exposure, open network rules, or infrastructure-as-code security gaps.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
  - development
  - engineering
---

# Cloud Security

Assesses cloud infrastructure for security misconfigurations, IAM privilege escalation paths, public storage exposure, and IaC security gaps across AWS, Azure, and GCP.

## When to use

… (sign up to view the full skill)
Sign up to view, copy, and install the full skill

More development skills

View all Development skills →

Generate

Scaffold code, tests, and boilerplate from a short spec.

Development

Performance Profiler

Systematic performance profiling for Node.js, Python, and Go applications.

Development

Threat Detection

Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.

Development

Agent Harness

Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.

Development