Menu
Audit IAM policies in CDK/CloudFormation/Terraform for least-privilege violations
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Analyze, group, and commit uncommitted changes as atomic conventional commits. Use this skill whenever the user says 'commit', 'commit this', 'commit these changes', 'commit my changes', 'smart commit', wants their diff split into logical commits, or asks to create a commit in any way. Always use this skill for committing — never run git commit directly.
Audit Claude Code configuration for security: check permissions, hooks, MCP servers, and settings
Create or update today's daily note at `~/knowledge/notes/journal/YYYY/MM-MMM/YYYY-MM-DD-DayName.md`, appending or replacing a session entry under `## Agent Summary`. Use when the user asks to update the daily note, log a session, append to the journal, or when invoked by the session-history hook after a session summary is written.
Edit config files inside the stow-based dotfiles repo and re-stow them with `make link`. Use this skill whenever the user asks to modify, add, or tweak any config under `$HOME` that lives in dotfiles — `.zshrc`, `.zshenv`, `.zprofile`, anything under `.config/`, `.local/`, `.claude/`, `.kiro/`, `.meshclaw/`, `.aws/`, `.unison/`, the `Makefile`, or any other tracked dotfile. Trigger even if the user phrases it as "change my config", "update my zshrc", "add this to claude settings", "tweak my tmux config", "modify my aliases", etc. — direct edits to `$HOME` are wrong because they bypass version control and get clobbered by the next `make link`.
Summarize unread emails via Outlook MCP, group by priority, draft replies
Automatic security scanning on every code change with CWE/OWASP mapping
| name | iam-audit |
| description | Audit IAM policies in CDK/CloudFormation/Terraform for least-privilege violations |
When asked to review IAM policies, audit permissions, or check for least-privilege compliance:
Find IAM definitions — Search the codebase for IAM policy definitions:
PolicyStatement, Role, Policy, Grant callsAWS::IAM::Role, AWS::IAM::Policy resourcesaws_iam_role, aws_iam_policy resourcesCheck for violations — Flag these patterns:
Action: "*" or Resource: "*" (overly broad — CWE-269)Condition blocks on sensitive actionsEffect: Allow on iam:*, s3:*, ec2:* without resource scopingaws:SourceArn or aws:SourceAccount conditions (confused deputy)NotAction / NotResource patterns (often misunderstood)Suggest fixes — For each violation:
Generate report — Produce an audit summary.
# IAM Audit Report
**Files Scanned**: X
**Policies Found**: X
**Violations**: X (Y critical, Z warnings)
## Findings
### [Critical] Wildcard action on S3 (CWE-269)
- File: `cdk/stack.py:45`
- Current: `s3:*` on `*`
- Recommended: Scope to specific actions and bucket ARN
- Fix: [code snippet]
### [Warning] Missing condition block
...