cloud-ai-security-skills

Assess Azure subscriptions against a curated subset of CIS Azure Foundations Benchmark v2.1. Automates 32 high-impact read-only checks across Identity, Defender for Cloud, Storage, Database, Logging, Networking, Compute, Key Vault, and App Service (~53% of the v2.1 benchmark). Use when the user mentions Azure CIS benchmark, Azure storage security, or unrestricted SSH/RDP detection in NSGs. Do NOT use for AWS or GCP; do NOT use to remediate findings (assessment-only, Reader role only); do NOT claim full CIS Azure coverage — only 32 of 60 controls are implemented, see the Roadmap section in this file for the gap.

Convert verified Microsoft Entra directoryAudit events into OCSF 1.8 API Activity (6003). The first slice maps Microsoft Graph directory audit events for service-principal credential changes, app-role grants, and federated identity credential creation into deterministic OCSF records while preserving Entra natural IDs such as id, correlationId, and activityDateTime for SIEM dedupe and downstream correlation. Use when the user mentions Entra audit log ingestion, Microsoft Graph directoryAudit normalization, or feeding Entra identity telemetry into an OCSF pipeline. Do NOT use for Okta System Log, Azure Activity Logs, or as a detector or policy engine — this skill only normalizes verified Microsoft Graph directoryAudit payloads.

Convert raw Kubernetes audit logs (`audit.k8s.io/v1`) into normalized API activity records, with OCSF as the default wire format and native output as an option. Maps user, source IP, verb, objectRef, and response status with enough fidelity for K8s privilege-escalation and secret-access detectors. Use when the user mentions Kubernetes audit logs, kube-apiserver audit sinks, K8s detection engineering, or feeding K8s audit into a SIEM. Do NOT use for container runtime logs, kubelet logs, or CloudTrail / GCP audit / Azure Activity. Do NOT use as a detection skill; this only normalizes events.

Convert verified Okta System Log events into OCSF 1.8 or native Identity & Access Management records. The first slice maps session and SSO events to Authentication (3002), user lifecycle and account-control changes to Account Change (3001), app/group membership updates to User Access Management (3005), and a narrow verified set of Okta Verify MFA challenge and denial events to Authentication (3002). It preserves Okta natural IDs such as uuid, published, transaction.id, and authenticationContext.externalSessionId for SIEM-friendly dedupe and correlation. Use when the user mentions Okta System Log ingestion, Okta audit log normalization, cross-vendor identity telemetry, or feeding Okta identity events into an OCSF pipeline or native canonical-first flow. Do NOT use for raw Azure Entra, Google Workspace, or AWS IAM logs. Do NOT use as a detector or policy engine — this skill only normalizes verified Okta event payloads into OCSF or native output.

Detect successful AWS IAM `CreateAccessKey` API calls against IAM users from OCSF 1.8 API Activity records emitted by ingest-cloudtrail-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) when a principal creates an access key for an IAM user. Use when the user mentions "AWS access key created", "IAM user key issuance", "additional cloud credentials in AWS", or "T1098.001 via CloudTrail". Do NOT use as a posture-at-rest access-key inventory check, to infer console-password or login-profile creation, or to claim every AWS identity-pivot path. This first slice only covers successful `CreateAccessKey` operations.

Detect MCP tool schema drift mid-session — the MCP tool-poisoning / rug-pull attack pattern. Reads OCSF 1.8 Application Activity (class 6002) or the native application-activity projection produced by ingest-mcp-proxy-ocsf, groups them by session, and flags any tool whose fingerprint (sha256 over name + description + inputSchema + annotations) changes between tools/list responses in the same session. Emits OCSF 1.8 Detection Finding (class 2004) with MITRE ATT&CK T1195.001 (Compromise Software Supply Chain) inside finding_info.attacks. Use when the user mentions MCP security, tool drift, tool poisoning, prompt injection via tool schema, or supply chain compromise of an MCP server. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use for cross-session drift (same tool, different sessions) — that is a legitimate MCP server update, not an attack; a separate detector will cover it. Do NOT use for divergence against an out-of-band server-registered baseline — that is detect-m

Detect suspicious prompt-injection and instruction-smuggling language in MCP tool descriptions from ingest-mcp-proxy-ocsf. Reads OCSF 1.8 Application Activity (class 6002) or the native application-activity projection, keeps a narrow high-signal scope, and flags `tools/list` responses whose tool descriptions explicitly tell an agent to ignore prior instructions, reveal a system or developer prompt, bypass guardrails, or exfiltrate secrets or conversation history. Emits OCSF 1.8 Detection Finding (class 2004) with MITRE ATLAS AML.T0051 Prompt Injection. Use when the user mentions MCP prompt injection, instruction smuggling in tool metadata, malicious tool descriptions, or AI-agent tool poisoning beyond simple schema drift. Do NOT use on raw MCP proxy logs — normalize them through ingest-mcp-proxy-ocsf first. Do NOT use as a general content-moderation classifier or on tool-call results; this slice only covers suspicious tool declarations in `tools/list` responses.

Assess GCP projects against a curated subset of CIS GCP Foundations Benchmark v3.0 controls. Automates 30 high-impact read-only checks across IAM, Cloud Storage, logging/monitoring, VPC networking, Compute Engine, Cloud SQL, and BigQuery. Use when the user mentions GCP CIS benchmark, GCP security posture, service account key audit, audit logging coverage, public bucket detection, Cloud SQL exposure, or BigQuery data protection. Do NOT use for AWS or Azure; do NOT use to remediate findings (assessment-only, zero write permissions); do NOT claim full CIS GCP coverage — 30 of ~60 numbered controls are implemented, see the Roadmap section for the remaining gap.

Convert raw AWS CloudTrail events (JSON or NDJSON, single events or CloudTrail digest files) into OCSF 1.8 API Activity events (class 6003). Maps userIdentity to OCSF actor, sourceIPAddress to src_endpoint, eventName to api.operation, eventSource to api.service.name, and infers activity_id (Create / Read / Update / Delete) from the event verb. Sets status_id to Failure when CloudTrail records an errorCode. Use when the user mentions CloudTrail ingestion, AWS audit log normalization, OCSF pipeline for AWS, or feeding CloudTrail into a SIEM. Do NOT use for GCP audit logs (use ingest-gcp-audit-ocsf), Azure activity logs (use ingest-azure-activity-ocsf), or Kubernetes audit logs (use ingest-k8s-audit-ocsf). Do NOT use as a detection skill — this skill only normalises events, it does not flag anything.

Convert raw MCP proxy logs (from agent-bom proxy or any MCP JSON-RPC middleware) into Application Activity records. OCSF 1.8 (class 6002) is the default output, with a native projection available via `--output-format native`. Every event carries session_uid, JSON-RPC method, direction, and a stable tool fingerprint (sha256 of name + description + inputSchema + annotations) so downstream detection skills can spot schema drift. Use when the user mentions MCP proxy logs, OCSF ingestion, detection engineering pipeline, or wants to feed MCP traffic into a SIEM or detection stack. Do NOT use for CloudTrail, GCP audit, Azure Activity, or K8s audit logs (use ingest-cloudtrail-ocsf / ingest-gcp-audit-ocsf / ingest-azure-activity-ocsf / ingest-k8s-audit-ocsf respectively). Do NOT use as a detection skill — this skill only normalises, it does not flag anything.

Convert OCSF 1.8 Detection Findings (class 2004) into Mermaid flowchart syntax suitable for inline rendering in PR comments, README files, and Markdown wikis. Produces a left-to-right attack flow showing each finding as actor → action → target chains, with MITRE ATT&CK technique IDs as edge labels and severity-coloured nodes. Multiple findings collapse into a single diagram so a reviewer sees the full attack chain in one picture. Use when the user mentions Mermaid, attack flow diagram, PR comment visualisation, README diagram for a detection result, or wants to embed a finding summary in Markdown without uploading SARIF. Do NOT use as a SARIF replacement (different audience: humans reading PRs vs GitHub code scanning UI). Do NOT use for non-finding OCSF events (class_uid != 2004) — those don't have the MITRE / actor / target structure this skill expects.

Revoke an AWS Security Group ingress rule flagged as open to the internet. Consumes an OCSF 1.8 Detection Finding (class 2004) emitted by detect-aws-open-security-group (T1190 Exploit Public-Facing Application) and calls EC2 RevokeSecurityGroupIngress to delete just the offending IpPermissions (the specific cidr+port combination, not the whole SG). Every action is dry-run by default, deny-listed against `default*` SG names, any SG carrying the `intentionally-open` tag, and any sg id in AWS_SG_REVOKE_PROTECTED_IDS. Apply requires AWS_SG_REVOKE_INCIDENT_ID + AWS_SG_REVOKE_APPROVER plus an explicit allowed-account binding via AWS_SG_REVOKE_ALLOWED_ACCOUNT_IDS. Dual audit (DynamoDB + KMS-encrypted S3). Reverify re-reads the SG via DescribeSecurityGroups and emits VERIFIED if no offending IpPermissions remain, DRIFT (+ paired OCSF Detection Finding via the shared remediation_verifier contract) if the rule came back, UNREACHABLE if the EC2 API throws. Use when the user mentions "revoke open security group," "close

Use when the user mentions "revoke open Azure NSG rule," "close Azure NSG public exposure," "respond to detect-azure-open-nsg," or "re-verify Azure NSG revoke." Surgical revoke of an Azure Network Security Group inbound rule flagged as open to `*` / `Internet` / `0.0.0.0/0` / `::/0` by detect-azure-open-nsg (T1190 Exploit Public-Facing Application). Default mode is `delete` — calls `NetworkManagementClient.security_rules.begin_delete()` against the specific rule (the cleanest reversible op since NSG rule definitions are versioned by Azure Resource Manager). Opt-in `--mode patch` rewrites `access: Deny` for the same priority+source+destination tuple via `begin_create_or_update()`. Every action is dry-run by default, deny-listed against `default*`/`Default*` rule names, NSG names ending `-protected`, the parent NSG's `intentionally-open` tag, and any rule-fully-qualified-id in AZURE_NSG_REVOKE_DENY_RULE_IDS. Apply requires AZURE_NSG_REVOKE_INCIDENT_ID + AZURE_NSG_REVOKE_APPROVER plus an explicit allowed-subscri

Contain a Kubernetes container-escape signal by planning, applying, or re-verifying a namespace-scoped deny-all NetworkPolicy for the targeted pod or workload selector. Consumes an OCSF 1.8 Detection Finding (class 2004) emitted by detect-container-escape-k8s and resolves the live selector from the Kubernetes API before emitting a native remediation plan or action record. Every action is dry-run by default, deny-listed for protected namespaces, gated behind an incident ID plus approver plus an explicit cluster allow-list for --apply, and dual-audited (DynamoDB + KMS-encrypted S3). The low-risk default remains reversible quarantine; explicit destructive follow-ups are also supported via `--approve-pod-kill` and `--approve-node-drain`, with the node-drain path requiring a second approver. Use when the user mentions "quarantine a suspicious Kubernetes pod," "contain container escape in Kubernetes," "apply deny-all NetworkPolicy after escape finding," "re-verify K8s quarantine policy," "kill the compromised pod,"

Contain a Microsoft Entra credential-addition or app-role-grant escalation by disabling the targeted service principal (accountEnabled=false) and emitting a triage payload that lists the SP's current keyCredentials, passwordCredentials, appRoleAssignments, and oauth2PermissionGrants for operator selective revocation. Consumes OCSF 1.8 Detection Findings (class 2004) from detect-entra-credential-addition (T1098.001) or detect-entra-role-grant-escalation (T1098.003) via Microsoft Graph v1.0. Every action is dry-run by default, deny-listed against tenant-bootstrap and break-glass principals (display-name prefix + ENTRA_PROTECTED_OBJECT_IDS env list), gated behind an incident ID plus approver for --apply, bound to an explicit tenant allow-list via ENTRA_REVOKE_ALLOWED_TENANT_IDS, and dual-audited (DynamoDB + KMS-encrypted S3). Re-verify confirms the SP is still disabled and emits a paired OCSF Detection Finding via the shared remediation_verifier contract on DRIFT (the SP was re-enabled). Use when the user mentio

Use when a GCP VPC firewall rule has been flagged as opening 0.0.0.0/0 or ::/0 to risky admin / DB / cache ports and you need to contain it. Consumes an OCSF 1.8 Detection Finding (class 2004) emitted by detect-gcp-open-firewall (T1190 Exploit Public-Facing Application) and surgically disables the offending firewall rule via Compute Engine `firewalls.patch` (default safe action: `disabled: true`) or, opt-in via `--mode delete`, removes it via `firewalls.delete`. Every action is dry-run by default, deny-listed against rule names matching `default-*`, rules whose `description` contains `intentionally-open`, and any rule name in GCP_FIREWALL_REVOKE_DENY_RULE_NAMES. Apply requires GCP_FIREWALL_REVOKE_INCIDENT_ID + GCP_FIREWALL_REVOKE_APPROVER plus an explicit allowed-project binding via GCP_FIREWALL_REVOKE_ALLOWED_PROJECT_IDS. Dual audit (DynamoDB + KMS-encrypted S3, same shared infra as the AWS pair, with `provider: "gcp"`). Reverify re-reads the rule via `firewalls.get` and emits VERIFIED if the rule is gone or

Revoke a Kubernetes RoleBinding or ClusterRoleBinding flagged by an RBAC self-grant finding. Consumes an OCSF 1.8 Detection Finding (class 2004) emitted by detect-privilege-escalation-k8s and plans, applies, or re-verifies deletion of the offending binding identified by the detector's binding.type and binding.name observables. Every action is dry-run by default, deny-listed for protected namespaces (kube-system, kube-public, istio-system, linkerd*) and protected binding names (any binding whose name starts with system:), gated behind an incident ID plus approver plus an explicit cluster allow-list for --apply, and dual-audited (DynamoDB + KMS-encrypted S3). Use when the user mentions "revoke a Kubernetes RoleBinding," "remove a ClusterRoleBinding after privilege escalation," "respond to RBAC self-grant alert," or "re-verify a K8s RBAC revocation." Do NOT use for NetworkPolicy quarantine, pod deletion, node drain, or cloud-IAM revocation — those belong to their own remediation skills. Out of scope for this ski

Quarantine an MCP tool flagged by detect-mcp-tool-drift (T1195.001 supply chain compromise) or detect-prompt-injection-mcp-proxy (MITRE ATLAS AML.T0051) by appending a structured entry to a JSONL quarantine file the operator's MCP client reads at startup or via hot-reload to exclude the tool from its discoverable surface. Every action is dry-run by default, deny-listed against MCP infrastructure prefixes (mcp_, system_, internal_), gated behind an incident ID plus two distinct approvers for --apply, and dual-audited (DynamoDB + KMS-encrypted S3). Re-verify reads the quarantine file and emits VERIFIED, DRIFT, or UNREACHABLE via the shared remediation_verifier contract — DRIFT also emits a paired OCSF Detection Finding so the gap flows back through the SIEM/SOAR pipeline. Use when the user mentions "quarantine an MCP tool," "block a poisoned MCP tool," "respond to MCP tool drift," "remediate prompt injection in MCP proxy," or "re-verify MCP tool quarantine." Do NOT use for cloud IAM revocation, Kubernetes conta

Contain an Okta account takeover by revoking all active sessions and OAuth refresh tokens for the affected user. Consumes an OCSF 1.8 Detection Finding (class 2004) emitted by detect-okta-mfa-fatigue or detect-credential-stuffing-okta and calls the Okta Users API to revoke sessions, revoke OAuth tokens, and optionally force password reset. Every action is dry-run by default, deny-listed against break-glass / admin / service-account principals, and dual-audited (DynamoDB + KMS-encrypted S3 object). Use when the user mentions "kill Okta session," "revoke Okta tokens after MFA fatigue," "Okta session kill," "contain Okta credential stuffing," or "Okta account takeover response." Do NOT use for Entra / Azure AD, Google Workspace, AWS IAM, or GCP sessions — those have their own per-IdP remediation skills. Do NOT bypass the deny-list, run with --apply without an explicit human-approved incident window, explicit Okta org allow-list, or edit the audit trail by hand.

Contain a Google Workspace account takeover by signing the user out and forcing a password change at next login. Consumes an OCSF 1.8 Detection Finding (class 2004) emitted by detect-google-workspace-suspicious-login (T1110 Brute Force / T1078 Valid Accounts) and calls the Admin SDK Directory API to invalidate active session tokens (POST /users/{userKey} /signOut) and require re-authentication on next sign-in (PATCH /users/{userKey} with changePasswordAtNextLogin=true). Every action is dry-run by default, deny-listed against admin / service-account / break-glass / @google.com principals (extensible via WORKSPACE_SESSION_KILL_DENY_LIST_FILE), gated behind an incident ID plus approver plus an explicit allowed-domain boundary for --apply, and dual-audited (DynamoDB + KMS-encrypted S3). Re-verify reads the Admin SDK Reports API for any login_success since remediation; emits VERIFIED if absent, DRIFT (+ paired OCSF Detection Finding via the shared remediation_verifier contract) if the attacker came back in, UNREAC

Detect credential-looking material leaked in MCP tool-call responses. Consumes the native/canonical application-activity projection from ingest-mcp-proxy-ocsf, scans `tools/call` response bodies for high-confidence token patterns (AWS access keys, GitHub tokens, OpenAI keys, Slack tokens), and emits an OCSF Detection Finding (class 2004) without echoing the raw secret back out. Use when the user mentions MCP credential exposure, leaked tool results, agent secret leakage, or OWASP MCP credential exposure in tool responses. Do NOT use on `tools/list` metadata, non-MCP logs, or as a semantic prompt-injection classifier. This first slice is a deterministic regex detector on native MCP response bodies.

Detect successful AWS S3 `GetObject` downloads of model-weight and checkpoint artifacts from OCSF 1.8 API Activity records emitted by ingest-cloudtrail-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1530 and MITRE ATLAS AML.T0035 when an S3 object read matches narrow model-artifact heuristics such as `.safetensors`, `.pt`, `.ckpt`, `pytorch_model.bin`, or `saved_model.pb`. Use when the user mentions "AWS model weights downloaded", "S3 model artifact collection", "checkpoint read from CloudTrail", or "AML.T0035 in AWS". Do NOT use for generic S3 egress, cross-account copy detection, or network-only exfiltration claims.

Detect successful GCS object downloads that look like model-weight or checkpoint artifact collection. Consumes OCSF 1.8 API Activity emitted by ingest-gcp-audit-ocsf and fires only on successful storage.googleapis.com/storage.objects.get events whose object path matches explicit model-artifact filename or suffix heuristics. Emits OCSF Detection Finding 2004 by default, with a native output mode for repo-local pipelines. Use when the user wants to spot suspicious model artifact collection from Cloud Storage. Do NOT use for generic bucket access monitoring, generic data exfiltration, or Azure/AWS object-store reads.

Detect MCP requests whose user prompt matches an entry in a curated adversarial-input fingerprint catalog. Reads OCSF 1.8 Application Activity (class 6002) records produced by ingest-mcp-proxy-ocsf, pattern-matches unmapped.mcp.prompt (or request.params.messages[].content for chat-shaped tool calls) against fingerprints in src/fingerprints.json, and emits one Detection Finding per matching request citing every matched fingerprint. Maps to MITRE ATLAS AML.T0043 Craft Adversarial Data plus the relevant OWASP LLM Top 10 entries (LLM01 prompt injection, LLM02 insecure output handling, LLM07 system-prompt leakage). Use when the user mentions prompt injection, jailbreak detection, system-prompt extraction, role-play hijack, or adversarial corpora. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use as a content classifier or a model-side guardrail; this is a deterministic pattern scanner over a frozen catalog.

Detect MCP server tools/list responses where any tool's inputSchema references a hostname not in MCP_PLUGIN_ALLOWED_HOSTS. Reads OCSF 1.8 Application Activity (class 6002) records produced by ingest-mcp-proxy-ocsf and walks the tool's JSON schema (oneOf / anyOf / allOf / properties / items / $ref / default / description) extracting every URL-shaped string. Fires once per (session, host) pair when the host falls outside the allowlist. Maps to OWASP LLM Top 10 LLM05 Supply Chain via Plugins/Tools. Use when the user mentions MCP plugin supply chain, untrusted schema $ref, LLM05, or tool inputSchema fetching remote definitions. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use as a generic URL scanner; the contract is scoped to inputSchema URLs in tools/list responses.

Detect MCP tools whose description or inputSchema has been mutated mid-session relative to an out-of-band server-registered baseline — the shadow-tool / tool-poisoning variant where the MCP server's startup snapshot is the trust anchor, not the first in-session sighting. Reads OCSF 1.8 Application Activity (class 6002) records produced by ingest-mcp-proxy-ocsf and compares the live tool's description/inputSchema sha256 hashes against the baseline file at MCP_TOOL_BASELINE_PATH ({tool_name: {description_sha256, schema_sha256, registered_at}}). Fires one Detection Finding per (session, tool) when either hash diverges from the baseline. Maps to OWASP MCP Top 10 Tool Poisoning. Use when the user mentions MCP shadow tools, tool poisoning with a server registration baseline, or MITRE T1195.001. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use for first-sight-in-session detection without a baseline — that is what detect-mcp-tool-drift covers.

Detect MCP tools whose response payloads systematically exceed operator-set output ceilings — the OWASP LLM10 Unbounded Resource Consumption pattern applied to the tool-output side of the loop. Reads OCSF 1.8 Application Activity (class 6002) records produced by ingest-mcp-proxy-ocsf and tracks per-(session_uid, tool_name) cumulative breaches where unmapped.mcp.response_size_bytes crosses MCP_TOOL_OUTPUT_BYTES_THRESHOLD (default 10 MiB) OR unmapped.mcp.response_line_count crosses MCP_TOOL_OUTPUT_LINES_THRESHOLD (default 50000). Fires one Detection Finding when MCP_TOOL_OUTPUT_REPEATED_BREACH_THRESHOLD (default 5) breaches accumulate in the same session for the same tool. Use when the user mentions tool-output exhaustion, MCP RLIMITs, unbounded LLM consumption, or OWASP LLM10. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use as a per-call rate limiter; this is a cumulative pattern detector that complements wrapper RLIMITs.

Detect MCP tool-call responses that look like leaked system-prompt or hidden instruction material from native or OCSF Application Activity records emitted by ingest-mcp-proxy-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATLAS AML.T0004 / AML.T0041 when a `tools/call` response contains explicit system-prompt markers such as `<system_prompt>`, "You are ChatGPT", "developer message", or "hidden instructions". Use when the user mentions "system prompt leakage", "prompt extraction", "hidden instructions exposed", or "LLM07 via MCP". Do NOT use for generic jailbreak language, semantic prompt leakage claims, or tool-description inspection.

Detect MCP tool-call responses that explicitly instruct an agent to exfiltrate conversation history, prompts, files, or secrets. Consumes native or OCSF Application Activity records from ingest-mcp-proxy-ocsf and emits OCSF 1.8 Detection Finding (class 2004) when a `tools/call` response contains high-confidence exfiltration language such as "send the conversation history", "upload local files", or "exfiltrate secrets". Use when the user mentions "tool-result exfiltration prompt injection", "response-layer data exfil instructions", or "MCP output says to upload secrets". Do NOT use for leaked credential material itself, tool descriptions, or semantic jailbreak claims.

Detect MCP tool-call responses that try to override an agent's safety or approval policy. Consumes native or OCSF Application Activity records from ingest-mcp-proxy-ocsf and emits OCSF 1.8 Detection Finding (class 2004) when a `tools/call` response explicitly tells the agent to ignore instructions, bypass policy or guardrails, skip approval, or hide actions from the user. Use when the user mentions "tool-result prompt injection", "response-layer policy bypass", "MCP output tells the agent to ignore policy", or "indirect prompt injection via tool results". Do NOT use for tool descriptions, generic unsafe text, or semantic jailbreak claims.

Audit the security posture of AI model serving infrastructure. Runs 20 read-only checks covering authentication, rate limiting, data egress controls, prompt injection surface, container isolation, TLS enforcement, and safety-layer configuration. Works with any serving config (JSON / YAML) — API gateways, Kubernetes deployments, cloud-native serving. Includes provider-shaped support for SageMaker, Bedrock, Vertex AI, Azure ML, and Azure AI Foundry endpoint configs. Use when the user mentions model endpoint security, serving infrastructure audit, API gateway security, prompt injection protection, model deployment review, or content safety check. Do NOT use to send live inference requests, mutate serving configs, or interact with the model — this skill only reads YAML/JSON. Do NOT use for runtime detection of prompt injection inside live traffic (a future detect-prompt-injection skill will cover that). Do NOT use for GPU cluster posture (use gpu-cluster-security).

Detect cloud lateral movement by joining normalized audit and flow telemetry in native or OCSF mode. Correlates a recent privileged identity pivot with accepted east-west traffic to an internal destination and emits a detection finding aligned to MITRE ATT&CK T1021 and T1078.004. Use when the user mentions lateral movement, east-west pivot, cloud identity abuse followed by internal traffic, or wants to detect attackers moving between cloud resources after initial access. Do NOT use on raw logs — pipe audit and network telemetry through their respective ingestion skills first. Do NOT use for pre-compromise detection. Do NOT use as an exfiltration detector.

Assess AWS accounts against CIS AWS Foundations Benchmark v3.0. Runs 22 automated read-only checks across IAM, Storage, Logging, Networking, and security services. Produces per-control pass/fail results with remediation commands. Optional `--auto-remediate` support adds dry-run-first plans for a narrow AWS-first control set (S3 encryption, S3 public access block, S3 versioning, unrestricted SSH/RDP SG rules), with `--apply` gated by incident + approver env vars, explicit allowed-account binding, CLI confirmation, and dual audit. Use when the user mentions AWS CIS benchmark, cloud security posture, IAM hygiene audit, S3 public access check, or CloudTrail validation. Do NOT use for GCP, Azure, or on-prem; do NOT use `--auto-remediate` for unsupported controls, for CloudTrail bootstrap, or to bypass protected-resource deny-lists.

Convert OCSF 1.8 Detection Findings (class 2004) into SARIF 2.1.0 results for upload to GitHub code scanning. Maps each finding's MITRE ATT&CK technique to a SARIF rule (ruleId = technique.uid), maps severity_id to SARIF level (CRITICAL/HIGH → error, MEDIUM → warning, LOW/INFO → note), and projects observables[] into SARIF locations and properties so the downstream Security tab carries the actor, target resource, and evidence pointers. Use when the user mentions SARIF, GitHub code scanning, GitHub Security tab, code scanning upload, or wants detection findings to land alongside dependency findings in the same UI. Do NOT use for OCSF events that are NOT Detection Findings (class 2004) — Compliance Findings (2003) and Inventory Info (5001) need different mappings; a future convert-ocsf-compliance-to-sarif will cover those. Do NOT use as a detection skill — this only converts.

Detect Google Workspace protected admin role grants, especially Super Admin, that occur outside an operator-maintained break-glass granter allow-list. Reads OCSF 1.8 Account Change (3001) or native events emitted by `ingest-workspace-admin-ocsf` with `application_name=admin`, role assignment parameters, and assignee details; emits OCSF Detection Finding (2004) tagged with MITRE ATT&CK T1098.003. Use when the user mentions Workspace admin role grants, Super Admin escalation, or break-glass governance. Do NOT use on raw Admin SDK payloads before normalization, on non-Workspace role events, or as a remediation skill.

Detect Salesforce API activity by a user or integration outside an operator-maintained baseline of approved clients, source IPs, or event-volume limits. Reads OCSF 1.8 Application Activity (6002) or native records emitted by `ingest-salesforce-event-mon-ocsf`, groups API events by actor and time window, and emits OCSF Detection Finding (2004) tagged with MITRE ATT&CK T1078.004. Use when the user mentions Salesforce API anomaly, suspicious integration, connected app drift, API usage spike, or unexpected source IP. Do NOT use on raw Event Monitoring data before normalization, non-Salesforce logs, or as remediation.

Detect AWS CloudTrail `PutEventSelectors` or `UpdateTrail` events that **structurally reduce audit scope** — `IncludeManagementEvents` flipped to false, `ReadWriteType` set to `None`, an empty `EventSelectors` array, or `IsMultiRegionTrail` collapsed from multi-region to single-region. Reads OCSF 1.8 API Activity (class 6003) records produced by `ingest-cloudtrail-ocsf` and emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1562.001 (Disable or Modify Tools — defense evasion). Use when the user mentions "CloudTrail audit scope narrowed", "PutEventSelectors emptied", "ReadWriteType set to None", "IncludeManagementEvents disabled", or "multi-region trail collapsed". Do NOT use for full `StopLogging` / `DeleteTrail` (covered by `detect-cloudtrail-disabled`), for per-event-selector data-resource subtraction in isolation (requires upstream diff context — see honesty note below), or on raw CloudTrail JSON before OCSF normalization.

Detect short-window bursts of high-signal AWS discovery APIs from OCSF 1.8 API Activity records emitted by ingest-cloudtrail-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1526 (Cloud Service Discovery) when one principal rapidly calls a narrow allow-list of CloudTrail discovery APIs across IAM, EC2, S3, KMS, Lambda, EKS, CloudTrail, and Organizations. Use when the user mentions "AWS discovery burst", "CloudTrail enumeration spree", "rapid Describe/List calls", or "T1526 via CloudTrail". Do NOT use as a generic anomaly detector for every read API, to claim all AWS discovery paths, or to infer exfiltration from read-only control-plane calls.

Detect successful AWS IAM `CreateLoginProfile` API calls against IAM users from OCSF 1.8 API Activity records emitted by ingest-cloudtrail-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) when a principal creates a console password login profile for an IAM user. Use when the user mentions "AWS login profile created", "IAM console password issued", "additional cloud credentials in AWS", or "T1098.001 via CloudTrail". Do NOT use as a posture-at-rest password policy check, to infer access-key creation, or to claim every AWS identity-pivot path. This first slice only covers successful `CreateLoginProfile` operations.

Detect AWS Security Group ingress rules opened to the internet (0.0.0.0/0 or ::/0) on risky admin / database / cache / search ports. Reads OCSF 1.8 API Activity (class 6003) records emitted by ingest-cloudtrail-ocsf, fires on successful AuthorizeSecurityGroupIngress calls whose granted permissions cover any of the configured risky ports (default: SSH, RDP, MySQL, Postgres, Redis, Mongo, Cassandra, Kafka, Elasticsearch, etc.), and emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1190 (Exploit Public-Facing Application). Use when the user mentions "detect open security groups," "AWS SG public exposure," "find internet-facing SG ingress," or "T1190 detection." Do NOT use as a remediator (pair with remediate-aws-sg-revoke), for GCP firewall rules (different shape — see #307 phase B), or as a posture check (CSPM evaluates state at rest; this detector fires on the create-event so response can be near-real-time). Out of scope: ICMP / non-IP protocols, VPC Network ACLs (different API surface