name	aws-scan-security
description	Evaluate IAM posture, public exposure, and security service status of the current AWS account.
model	opus
effort	high
context	fork

Procedure

ASE-1. Verify prerequisites. ASE-2. IAM posture (pass --profile $AWS_PROFILE --region $AWS_DEFAULT_REGION):

Root MFA: aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'
Users without MFA: aws iam list-virtual-mfa-devices --assignment-status Unassigned
Admin policies on users: aws iam list-attached-user-policies per user, flag AdministratorAccess
Access keys >90 days: aws iam list-access-keys, check CreateDate ASE-3. Public exposure:
Public S3: aws s3api get-bucket-acl + aws s3api get-bucket-policy-status per bucket
SGs 0.0.0.0/0 on 22/3389/3306/5432: aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0
Public RDS: aws rds describe-db-instances --query 'DBInstances[?PubliclyAccessible==\true`]'ASE-4. Security services: CloudTrail, GuardDuty, AWS Config, Security Hub (describe/list/get commands) ASE-5. Write raw findings to$AWS_STATE_DIR/security-.json(severity: critical/high/medium/low). ASE-6. Write human-readable summary to$AWS_STATE_DIR/security-.md`:
Severity table: critical/high/medium/low counts
One bullet per finding category (no identifiers) ASE-7. Print: counts by severity only — no identifiers.

Rules

Read-only only. Identifiers must NOT appear in conversation.
Critical findings must be highlighted.
AccessDeniedException → mark as unknown (not pass).

Skip Conditions

Skip if $AWS_STATE_DIR/security-<YYYYMMDD>.json exists and is less than 4 hours old.

Más de este repositorio

mismo repositorio

clarify-intent

nirecom/agents

Conduct a decision-tree interview with the user to lock in requirements, motivation, scope, and non-goals before planning.

2026-07-112

make-detail-plan

nirecom/agents

Stage 3 of three-stage planning pipeline. Produce a file-level implementation plan via detail-planner/detail-reviewer loop, then get user approval. Inputs are confirmed intent (<session-id>-intent.md) and outline (<session-id>-outline.md) from prior stages.

2026-07-112

write-code

nirecom/agents

Edit source code for the current task. Delegates editing and lint/typecheck/self-repair to a subagent.

2026-07-112

write-tests

nirecom/agents

Plan and write test cases with high reasoning effort. Test iteration runs in a subagent to minimize confirmations.

2026-07-112

survey-code

nirecom/agents

Explore the codebase to understand existing patterns, constraints, and relevant files before planning.

2026-07-112

survey-history

nirecom/agents

Investigate git history, docs/history.md, and GitHub issue/PR timeline since the relevant issue opened, to surface changes that may invalidate the issue's premises.

2026-07-112

name	aws-scan-security
description	Evaluate IAM posture, public exposure, and security service status of the current AWS account.
model	opus
effort	high
context	fork

Procedure

ASE-1. Verify prerequisites. ASE-2. IAM posture (pass --profile $AWS_PROFILE --region $AWS_DEFAULT_REGION):

Root MFA: aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'
Users without MFA: aws iam list-virtual-mfa-devices --assignment-status Unassigned
Admin policies on users: aws iam list-attached-user-policies per user, flag AdministratorAccess
Access keys >90 days: aws iam list-access-keys, check CreateDate ASE-3. Public exposure:
Public S3: aws s3api get-bucket-acl + aws s3api get-bucket-policy-status per bucket
SGs 0.0.0.0/0 on 22/3389/3306/5432: aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0
Public RDS: aws rds describe-db-instances --query 'DBInstances[?PubliclyAccessible==\true`]'ASE-4. Security services: CloudTrail, GuardDuty, AWS Config, Security Hub (describe/list/get commands) ASE-5. Write raw findings to$AWS_STATE_DIR/security-.json(severity: critical/high/medium/low). ASE-6. Write human-readable summary to$AWS_STATE_DIR/security-.md`:
Severity table: critical/high/medium/low counts
One bullet per finding category (no identifiers) ASE-7. Print: counts by severity only — no identifiers.

Rules

Read-only only. Identifiers must NOT appear in conversation.
Critical findings must be highlighted.
AccessDeniedException → mark as unknown (not pass).

Skip Conditions

Skip if $AWS_STATE_DIR/security-<YYYYMMDD>.json exists and is less than 4 hours old.