원클릭으로 Manus에서 모든 스킬 실행

infra-audit

스타2

포크1

업데이트2026년 4월 3일 21:29

Audit infrastructure configuration for security and best practices. Reviews Terraform, Docker, CI/CD pipelines, and cloud config for misconfigurations, overly permissive permissions, and missing security controls. Trigger phrases: "infra audit", "terraform review", "docker audit", "infrastructure review", "forge infra-audit", "check infra", "audit infrastructure".

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

brunobracaioli

brunobracaioli/claude-forge

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Infrastructure Security Audit

Review all infrastructure-as-code for security misconfigurations and best practices.

Workflow

Step 1: Discover IaC Files

Scan for:
- terraform/**/*.tf
- Dockerfile, docker-compose*.yml
- .github/workflows/*.yml, .gitlab-ci.yml, Jenkinsfile
- kubernetes/*.yaml, k8s/*.yaml, helm/**
- serverless.yml, vercel.json, netlify.toml
- ansible/**/*.yml, pulumi/**

If $ARGUMENTS is provided, audit only that path.

Step 2: Terraform Audit

For each .tf file found:

State & Backend

Remote backend configured (not local state)?
State encryption enabled?
State locking configured (DynamoDB/GCS)?

IAM & Permissions

No wildcard (*) in IAM policy actions or resources
No inline policies (use managed or customer policies)
Each service has its own role (no shared roles)
No AdministratorAccess or PowerUser attached

Network

No security groups with 0.0.0.0/0 on non-HTTP ports
Private subnets for databases and internal services
VPC flow logs enabled
No public IPs on internal services

Data

Encryption at rest on all storage (S3, RDS, EBS, DynamoDB)
Encryption in transit (TLS)
No public S3 buckets unless explicitly intended
Backup and point-in-time recovery enabled on databases
Secrets in AWS Secrets Manager/SSM, not in variables

Compute

ECR image scanning enabled
ECS tasks with non-root users
Container health checks defined
CloudWatch/monitoring enabled

Step 3: Docker Audit

For each Dockerfile:

Multi-stage build (no dev deps in final image)?
Non-root USER directive?
Specific base image tags (no :latest)?
No secrets in build args or COPY
HEALTHCHECK defined?
.dockerignore exists and excludes .env, .git, node_modules?

For docker-compose files:

No hardcoded passwords (use env_file or secrets)
Volumes don't mount sensitive host paths
No privileged mode unless required
Resource limits defined for production

Step 4: CI/CD Pipeline Audit

For each workflow/pipeline:

No secrets hardcoded in workflow files
Secrets passed via GitHub Secrets / CI variables
Actions/images pinned to specific versions (no @latest)
GITHUB_TOKEN has minimal permissions (not write-all)
No artifact uploads containing secrets
Deployment requires approval for production
OIDC preferred over long-lived access keys

Step 5: Report

## Infrastructure Audit Report
Date: <timestamp>
Scope: <path or "all IaC">

### IaC Files Found
- Terraform: X files
- Docker: X files
- CI/CD: X workflows
- Other: ...

### Critical
- [CATEGORY] <finding> — file:line
  Risk: <what could happen>
  Fix: <specific remediation>

### High
...

### Medium
...

### Best Practice Recommendations
- <actionable suggestion>

이 저장소의 다른 Skills

같은 저장소

claude-forge

brunobracaioli/claude-forge

Bootstrap the complete .claude/ directory structure for any new project with replicable templates, CLAUDE.md, rules, skills, agents, hooks, and settings. Use this skill whenever the user says "bootstrap project", "mount project structure", "setup claude code", "initialize .claude", "start new project", "monte a estrutura do projeto", "prepare project for claude code", "scaffold claude config", or any variation asking to set up Claude Code configuration for a new or existing codebase. Also trigger when the user asks to "create CLAUDE.md template", "setup skills", or wants a replicable project skeleton. Supports stack-specific variants including django, flask-next, go, laravel, node, python, react, and rust. Supports architecture presets: mvp (monolith, Supabase+Vercel), production-aws (multi-service, Terraform, AWS: VPC + RDS + ECS Fargate), or production-gcp (multi-service, Terraform, GCP: VPC + Cloud SQL + Cloud Run, WIF-based CI/CD).

2026-04-222

spec-build

brunobracaioli/claude-forge

Spec-driven project build using Agent Teams. Reads a SPEC.md file (or receives a feature description), creates a shared API contract, then spawns a multi-agent team to implement backend and frontend in parallel. Includes security validation and checkpoint creation on success. Use when the user says "build from spec", "implement the spec", "spec-build", "build this project", "monte o projeto a partir do spec", or wants to go from specification to working code using parallel agents.

2026-04-032

checkpoint

brunobracaioli/claude-forge

Create a development checkpoint: run tests, commit clean state, tag with version, and save context summary for session continuity. Use when you want to mark a stable point in development before switching context, ending a session, or starting a risky change. Trigger phrases: "checkpoint", "save progress", "mark stable", "create checkpoint", "snapshot", "save state", "forge checkpoint".

2026-04-032

pentest-recon

brunobracaioli/claude-forge

Perform passive reconnaissance and attack surface mapping from the codebase. Identifies exposed endpoints, auth flows, input vectors, and potential attack paths for authorized security testing. For use in pentesting engagements, CTF, or internal security assessments only. Trigger phrases: "pentest recon", "attack surface", "map endpoints", "recon", "forge pentest-recon", "threat model", "attack surface mapping".

2026-04-032

security-audit

brunobracaioli/claude-forge

Run a comprehensive OWASP-based security audit on the codebase. Checks for injection, broken auth, sensitive data exposure, misconfigurations, and known vulnerable dependencies. Trigger phrases: "security audit", "owasp check", "security review", "vuln scan", "forge security-audit", "check security".

2026-04-032

commit

brunobracaioli/claude-forge

Stage changes, generate a conventional commit message, and commit.

2026-03-302

name	infra-audit
description	Audit infrastructure configuration for security and best practices. Reviews Terraform, Docker, CI/CD pipelines, and cloud config for misconfigurations, overly permissive permissions, and missing security controls. Trigger phrases: "infra audit", "terraform review", "docker audit", "infrastructure review", "forge infra-audit", "check infra", "audit infrastructure".
argument-hint	[optional: specific path — terraform/, Dockerfile, .github/workflows/]
allowed-tools	Read, Bash, Glob, Grep

Infrastructure Security Audit

Review all infrastructure-as-code for security misconfigurations and best practices.

Workflow

Step 1: Discover IaC Files

Scan for:
- terraform/**/*.tf
- Dockerfile, docker-compose*.yml
- .github/workflows/*.yml, .gitlab-ci.yml, Jenkinsfile
- kubernetes/*.yaml, k8s/*.yaml, helm/**
- serverless.yml, vercel.json, netlify.toml
- ansible/**/*.yml, pulumi/**

If $ARGUMENTS is provided, audit only that path.

Step 2: Terraform Audit

For each .tf file found:

State & Backend

Remote backend configured (not local state)?
State encryption enabled?
State locking configured (DynamoDB/GCS)?

IAM & Permissions

No wildcard (*) in IAM policy actions or resources
No inline policies (use managed or customer policies)
Each service has its own role (no shared roles)
No AdministratorAccess or PowerUser attached

Network

No security groups with 0.0.0.0/0 on non-HTTP ports
Private subnets for databases and internal services
VPC flow logs enabled
No public IPs on internal services

Data

Encryption at rest on all storage (S3, RDS, EBS, DynamoDB)
Encryption in transit (TLS)
No public S3 buckets unless explicitly intended
Backup and point-in-time recovery enabled on databases
Secrets in AWS Secrets Manager/SSM, not in variables

Compute

ECR image scanning enabled
ECS tasks with non-root users
Container health checks defined
CloudWatch/monitoring enabled

Step 3: Docker Audit

For each Dockerfile:

Multi-stage build (no dev deps in final image)?
Non-root USER directive?
Specific base image tags (no :latest)?
No secrets in build args or COPY
HEALTHCHECK defined?
.dockerignore exists and excludes .env, .git, node_modules?

For docker-compose files:

No hardcoded passwords (use env_file or secrets)
Volumes don't mount sensitive host paths
No privileged mode unless required
Resource limits defined for production

Step 4: CI/CD Pipeline Audit

For each workflow/pipeline:

No secrets hardcoded in workflow files
Secrets passed via GitHub Secrets / CI variables
Actions/images pinned to specific versions (no @latest)
GITHUB_TOKEN has minimal permissions (not write-all)
No artifact uploads containing secrets
Deployment requires approval for production
OIDC preferred over long-lived access keys

Step 5: Report

## Infrastructure Audit Report
Date: <timestamp>
Scope: <path or "all IaC">

### IaC Files Found
- Terraform: X files
- Docker: X files
- CI/CD: X workflows
- Other: ...

### Critical
- [CATEGORY] <finding> — file:line
  Risk: <what could happen>
  Fix: <specific remediation>

### High
...

### Medium
...

### Best Practice Recommendations
- <actionable suggestion>