infra-security-review

Security patterns and checklists for reviewing Infrastructure-as-Code. Covers Terraform/OpenTofu state, secrets, network, compute, database, and storage security.

Aller à l'installation

Dépôt: majesticlabs-dev/majestic-marketplace
Dernière activité de la source: 12 janvier 2026 à 05:18
Langue détectée de SKILL.md: anglais
Étoiles: 47
Forks: 11

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/majesticlabs-dev/majestic-marketplace --skill infra-security-review

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

Check	Severity	Pattern
Root login enabled	High	`PermitRootLogin yes` in cloud-init
Password auth enabled	Medium	`PasswordAuthentication yes`
Missing SSH hardening	Low	No `ClientAliveInterval` config
No monitoring	Low	`monitoring = false`

Check	Severity	Pattern
Public database access	Critical	No database firewall rules
No VPC attachment	High	Missing `private_network_uuid`
Weak version	Medium	Old database engine versions
Single node for production	Low	`node_count = 1` in prod

# Hardcoded secrets
grep -rE 'AKIA[0-9A-Z]{16}' *.tf
grep -rE 'password\s*=\s*"[^$\{][^"]*"' *.tf
grep -rE 'secret.*=\s*"[^$\{][^"]*"' *.tf
grep -rE 'api_key\s*=\s*"' *.tf

# Network exposure
grep -rE '0\.0\.0\.0/0.*22' *.tf
grep -rE 'cidr_blocks.*0\.0\.0\.0/0' *.tf
grep -rE 'publicly_accessible\s*=\s*true' *.tf

# State security
grep -rE 'encrypt\s*=\s*false' *.tf
grep -rE 'block_public_acls\s*=\s*false' *.tf

# Cloud-init issues
grep -rE 'PermitRootLogin\s+yes' *.tf *.yaml
grep -rE 'PasswordAuthentication\s+yes' *.tf *.yaml

# Infrastructure Security Review

**Repository:** [name]
**Date:** [date]
**Files Reviewed:** [count]

## Summary

| Severity | Count |
|----------|-------|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |

## Findings

### [SEVERITY-001] Title

**File:** `path/to/file.tf:line`
**Resource:** `resource_type.name`

**Issue:**
Description of the security issue.

**Current:**
```hcl
[current code]

[fixed code]


## Severity Guide

| Severity | Definition | Action |
|----------|------------|--------|
| Critical | Direct security exposure, data breach risk | Block deployment |
| High | Significant risk, exploitable weakness | Fix before production |
| Medium | Best practice violation, indirect risk | Fix within 30 days |
| Low | Minor hardening opportunity | Address when convenient |

Check	Severity	Pattern
S3 bucket without encryption	Critical	`encrypt = false` or missing
Missing state locking	High	No DynamoDB table configured
Public bucket policy	Critical	`block_public_*` not all true
Missing versioning	Medium	`versioning` not enabled

Check	Severity	Pattern
Hardcoded AWS keys	Critical	`AKIA[0-9A-Z]{16}`
Hardcoded passwords	Critical	`password\s=\s"[^"]+[^}]"`
Database credentials in code	Critical	`DATABASE_URL` with password
API keys in variables	High	`api_key`, `secret_key` defaults

Check	Severity	Pattern
S3 bucket without encryption	Critical	`encrypt = false` or missing
Missing state locking	High	No DynamoDB table configured
Public bucket policy	Critical	`block_public_*` not all true
Missing versioning	Medium	`versioning` not enabled

Check	Severity	Pattern
Hardcoded AWS keys	Critical	`AKIA[0-9A-Z]{16}`
Hardcoded passwords	Critical	`password\s=\s"[^"]+[^}]"`
Database credentials in code	Critical	`DATABASE_URL` with password
API keys in variables	High	`api_key`, `secret_key` defaults

SSH open to world	Critical	`0.0.0.0/0` on port 22
Database publicly accessible	Critical	Missing `private_network_uuid`
Wide CIDR ranges	Medium	`/8`, `/16` on public resources
Missing firewall	High	Droplet without firewall resource

infra-security-review

Options d'installation

Vérifiez les fichiers source

Infrastructure Security Review Patterns

Security Checklists

State Backend Security

Secret Exposure

Network Security

Infrastructure Security Review Patterns

Security Checklists

State Backend Security

Secret Exposure

Network Security

Compute Security

Database Security

Storage Security

Grep Patterns

Report Template

Compliance Notes

name	infra-security-review
description	Security patterns and checklists for reviewing Infrastructure-as-Code. Covers Terraform/OpenTofu state, secrets, network, compute, database, and storage security.

Check	Severity	Pattern
Public S3 buckets	Critical	`acl = "public-read"`
Missing encryption	High	No SSE configuration
No access logging	Medium	Missing access log bucket

infra-security-review

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt

Infrastructure Security Review Patterns

Security Checklists

State Backend Security

Secret Exposure

Network Security

Infrastructure Security Review Patterns

Security Checklists

State Backend Security

Secret Exposure

Network Security

Compute Security

Database Security

Storage Security

Grep Patterns

Report Template

Compliance Notes