메뉴
Lightweight report engine. Reads all skill results, deduplicates, prioritizes, and outputs findings as terminal table + CSV + HTML. No remediation.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Foundational repository intelligence. Maps IaC architecture, environments, exposure, and trust boundaries. Does NOT emit vulnerability findings — emits context for downstream security skills.
Cross-skill attack chain correlation engine. Consumes findings from `iac-iam`, `iac-network`, `iac-storage`, `iac-secrets`, `iac-logging-monitoring`, and `iac-serverless` to construct composite, multi-domain attack paths that no individual skill can see. Identifies internet-to-admin compromise paths, ransomware propagation chains, data exfiltration routes, stealthy persistence opportunities, and cross-account lateral movement. Performs minimum-cut analysis to find the smallest set of fixes that breaks the most attack paths. Emits chained findings consumable by `iac-report`.
Single-pass, token-optimized IaC security scan. Covers all 6 domains in one file. Use instead of individual skills when running "Run fast IaC scan".
Deep IAM and identity-layer security analysis for Infrastructure-as-Code. Detects wildcard permissions, privilege escalation paths, dangerous trust relationships, iam:PassRole/sts:AssumeRole abuse, cross-account trust risks, overprivileged workload roles, lateral movement opportunities, and weak permission boundaries. Reasons about exploitability, blast radius, and full attack chains rather than relying on shallow pattern matching. Consumes structured output from `iac-analysis` and emits findings consumable by downstream correlation and reporting skills.
Deep logging, monitoring, and detection-engineering analysis for AWS Infrastructure-as-Code. Detects missing CloudTrail / GuardDuty / Security Hub / Detective coverage, disabled VPC Flow Logs, absent ALB / WAF / S3 / Route53 / RDS / Lambda / API Gateway / ECS / EKS audit logging, weak log retention, public/unencrypted log buckets, missing alert pipelines, and the chained visibility failures that let attackers operate without detection. Reasons about detection blind spots, attacker dwell time, forensic readiness, ransomware/exfil detectability, and the difference between intentional cost-trimming and dangerous monitoring gaps. Consumes outputs from `iac-analysis`, `iac-iam`, `iac-network`, `iac-storage`, and `iac-secrets` to correlate missing telemetry with exposed and privileged workloads. Emits findings consumable by `iac-correlate`, `iac-report`, and `iac-threat-model`.
Deep network-layer security analysis for Infrastructure-as-Code. Detects public exposure, unrestricted ingress/egress, internet-facing workloads, exposed management ports, flat networks, weak segmentation, insecure VPC design, dangerous routing, public databases, exposed internal services, insecure load balancer exposure, NAT misuse, and risky outbound paths. Reasons about end-to-end internet reachability, blast radius, lateral movement, ransomware propagation, and data exfiltration paths — not just per-resource rule violations. Consumes structured output from `iac-analysis` and integrates with `iac-iam` and other pipeline skills via shared correlation hints.
| name | iac-report |
| description | Lightweight report engine. Reads all skill results, deduplicates, prioritizes, and outputs findings as terminal table + CSV + HTML. No remediation. |
Do NOT generate remediation advice, fix suggestions, code changes, or "how to fix" guidance. Report what is wrong and where — never how to fix it.
Read all iac-scan/*-results.md files. Deduplicate, prioritize, and output:
iac-scan/findings.csviac-scan/report.html (self-contained, single file)Read these files from iac-scan/ (skip any that don't exist):
analysis.mdiam-results.mdnetwork-results.mdstorage-results.mdsecrets-results.mdlogging-monitoring-results.mdserverless-results.mdattack-chain-results.mdExtract every finding. Each finding must have: ID, title, severity, confidence, domain, file, line, risk summary.
If two findings from different skills describe the same issue on the same resource, keep one:
Sort findings by priority score:
score = severity_weight × 0.35 + exploitability_weight × 0.30 + blast_weight × 0.20 + confidence × 15
| Severity | Weight | Exploitability | Weight | Blast radius | Weight |
|---|---|---|---|---|---|
| Critical | 100 | direct | 100 | account | 100 |
| High | 75 | near | 75 | service | 70 |
| Medium | 50 | far | 40 | resource_set | 40 |
| Low | 25 | theoretical | 10 | single | 15 |
| Info | 5 |
Confidence (0.0–1.0) is multiplied by 15 and added directly. Low-confidence findings naturally rank lower.
Assign priority tiers after scoring:
Print a summary table to stdout:
╔══════════════════════════════════════════════════════════════════════════════════╗
║ IaC Security Scan Results ║
║ Repository: {path} | Date: {date} | Findings: {N} ║
╠══════════════════════════════════════════════════════════════════════════════════╣
CRITICAL: {n} HIGH: {n} MEDIUM: {n} LOW: {n} INFO: {n}
╔════╦══════════╦════════╦══════╦═══════════════════════════════╦═════════════════╗
║ P ║ Severity ║ Conf. ║ Dom ║ Title ║ Location ║
╠════╬══════════╬════════╬══════╬═══════════════════════════════╬═════════════════╣
║ P0 ║ CRITICAL ║ 0.95 ║ IAM ║ Admin wildcard on Lambda role ║ iam.tf:42 ║
║ P0 ║ CRITICAL ║ 0.92 ║ NET ║ RDS publicly accessible ║ rds.tf:18 ║
║ P1 ║ HIGH ║ 0.88 ║ SEC ║ AWS key in user data ║ ec2.tf:95 ║
║ ...║ ║ ║ ║ ║ ║
╚════╩══════════╩════════╩══════╩═══════════════════════════════╩═════════════════╝
Full report: iac-scan/report.html
CSV export: iac-scan/findings.csv
Domain abbreviations: IAM, NET, STR, SEC, LOG, SLS, CHN (attack chain), RPT (compound).
Write iac-scan/findings.csv with these columns:
priority,severity,confidence,domain,id,title,resource,file,line,risk,environment,related_ids
Write iac-scan/report.html — a single self-contained HTML file. All CSS inline, no external dependencies.
Resource A → Resource B → Resource Cprefers-color-scheme)@media print rules for clean printoutWhen findings from different skills converge on the same resource, create a compound finding:
related_idsOnly create compound findings for these patterns:
If iac-scan/analysis.md contains enough architecture data (VPCs, subnets, resources), generate iac-scan/architecture-diagram.html:
Confidence label in header:
Subtitle: "Generated from static IaC analysis. Runtime state may differ."
If the project has fewer than 5 resources, skip the diagram.