iac-security-scan-skills

Foundational repository intelligence. Maps IaC architecture, environments, exposure, and trust boundaries. Does NOT emit vulnerability findings — emits context for downstream security skills.

Cross-skill attack chain correlation engine. Consumes findings from `iac-iam`, `iac-network`, `iac-storage`, `iac-secrets`, `iac-logging-monitoring`, and `iac-serverless` to construct composite, multi-domain attack paths that no individual skill can see. Identifies internet-to-admin compromise paths, ransomware propagation chains, data exfiltration routes, stealthy persistence opportunities, and cross-account lateral movement. Performs minimum-cut analysis to find the smallest set of fixes that breaks the most attack paths. Emits chained findings consumable by `iac-report`.

Single-pass, token-optimized IaC security scan. Covers all 6 domains in one file. Use instead of individual skills when running "Run fast IaC scan".

Deep IAM and identity-layer security analysis for Infrastructure-as-Code. Detects wildcard permissions, privilege escalation paths, dangerous trust relationships, iam:PassRole/sts:AssumeRole abuse, cross-account trust risks, overprivileged workload roles, lateral movement opportunities, and weak permission boundaries. Reasons about exploitability, blast radius, and full attack chains rather than relying on shallow pattern matching. Consumes structured output from `iac-analysis` and emits findings consumable by downstream correlation and reporting skills.

Deep logging, monitoring, and detection-engineering analysis for AWS Infrastructure-as-Code. Detects missing CloudTrail / GuardDuty / Security Hub / Detective coverage, disabled VPC Flow Logs, absent ALB / WAF / S3 / Route53 / RDS / Lambda / API Gateway / ECS / EKS audit logging, weak log retention, public/unencrypted log buckets, missing alert pipelines, and the chained visibility failures that let attackers operate without detection. Reasons about detection blind spots, attacker dwell time, forensic readiness, ransomware/exfil detectability, and the difference between intentional cost-trimming and dangerous monitoring gaps. Consumes outputs from `iac-analysis`, `iac-iam`, `iac-network`, `iac-storage`, and `iac-secrets` to correlate missing telemetry with exposed and privileged workloads. Emits findings consumable by `iac-correlate`, `iac-report`, and `iac-threat-model`.

Deep network-layer security analysis for Infrastructure-as-Code. Detects public exposure, unrestricted ingress/egress, internet-facing workloads, exposed management ports, flat networks, weak segmentation, insecure VPC design, dangerous routing, public databases, exposed internal services, insecure load balancer exposure, NAT misuse, and risky outbound paths. Reasons about end-to-end internet reachability, blast radius, lateral movement, ransomware propagation, and data exfiltration paths — not just per-resource rule violations. Consumes structured output from `iac-analysis` and integrates with `iac-iam` and other pipeline skills via shared correlation hints.

Lightweight report engine. Reads all skill results, deduplicates, prioritizes, and outputs findings as terminal table + CSV + HTML. No remediation.

Secrets and credentials analysis for IaC and CI/CD. Detects hardcoded keys, plaintext env vars, state file risks. Contextual validation — not regex-only. Correlates with IAM, network, storage. No remediation.

Serverless security analysis for AWS IaC. Detects insecure Lambda/API Gateway/Function URL exposure, overprivileged execution roles, event injection, privilege escalation via orchestration, denial-of-wallet, and serverless persistence. No remediation.

Deep storage and data security analysis for AWS Infrastructure-as-Code. Detects unencrypted data stores, public S3 buckets, missing backup/DR posture, dangerous access patterns, ransomware readiness gaps, data classification issues, and storage-layer attack surfaces. Consumes structured output from `iac-analysis` and emits findings consumable by `iac-attack-chain` and `iac-report`.