| name | generate-v3 |
| description | Generate all security control artifacts and compliant IaC templates from mapping-results.json and validated.json. Split into 3 focused sub-skills for better accuracy; this skill orchestrates them. |
| disable-model-invocation | false |
| argument-hint | [--service=<name>] [--include-unverified] |
Service Approval — Control Generator v3
Read .service-approval/<slug>/04-map/mapping-results.json (produced by Mapper) for controls and
framework mappings. Read .service-approval/<slug>/03-validate/validated.json (produced by Validator v3)
for API surface and capabilities. Generate artifacts organized by the Controls Matrix
(Category x Scope). Write to .service-approval/<slug>/05-generate/.
Sub-Skill Architecture
This skill is split into 3 focused sub-skills that write to separate directories:
| Sub-Skill | Focus | Output Directory |
|---|
generate-preventive | SCPs, resource policies, KMS key policies, permission boundaries, tag policies, OPA, CFN Guard | <slug>/05-generate/preventive/, <slug>/05-generate/proactive/ |
generate-detective | Config rules, Lambda handlers, EventBridge, CloudWatch, SSM runbooks, Step Functions | <slug>/05-generate/detective/, <slug>/05-generate/responsive/ |
generate-iac | Terraform modules, CDK TypeScript, CloudFormation YAML, CDK for Terraform | <slug>/05-generate/iac/ |
When invoked directly (via /generate), this skill runs all 3 sub-skills sequentially.
When invoked by the orchestrator, the orchestrator dispatches sub-skills in parallel.
Agent model rule
When spawning subagents (via the Agent tool) for parallel artifact generation, do NOT specify
a model parameter. Omitting model causes subagents to inherit the caller's model.
Prerequisites
Hard gate — halts the run if upstream phases are incomplete.
python3 -m tools.validate.check_phase_complete --slug <slug> --phase 03-validate || exit 2
python3 -m tools.validate.check_phase_complete --slug <slug> --phase 04-map || exit 2
mkdir -p .service-approval/<slug>/05-generate/{proactive,preventive,detective,responsive,iac}
mkdir -p .service-approval/<slug>/05-generate/proactive/opa-policies
mkdir -p .service-approval/<slug>/05-generate/responsive/lambda-remediator
mkdir -p .service-approval/<slug>/05-generate/detective/config-rule-lambdas
The check_phase_complete CLI verifies every required artifact (mapping-results.json,
controls-catalog.md, framework-mapping.md, validated.json, etc.) exists and is
non-stub. Without this gate, generate would silently skip controls when its
inputs are missing, producing an empty 05-generate/ tree.
Create Terraform module directories:
for asset in $(python3 -c "import json; d=json.load(open('.service-approval/<slug>/03-validate/validated.json')); [print(a['name'].lower().replace(' ','-')) for a in d['assets']]"); do
mkdir -p ".service-approval/<slug>/05-generate/iac/modules/${asset}"
done
mkdir -p .service-approval/<slug>/05-generate/iac/modules/_shared
Direct Invocation Mode (Sequential)
When this skill is invoked directly (not by orchestrator):
Step 1: Run generate-preventive
Follow ALL instructions in skills/generate-preventive/SKILL.md.
Pass: --service, --include-unverified if set.
Wait for <slug>/05-generate/preventive/ and <slug>/05-generate/proactive/ to be populated.
Step 2: Run generate-detective
Follow ALL instructions in skills/generate-detective/SKILL.md.
Pass: --service, --include-unverified if set.
Wait for <slug>/05-generate/detective/ and <slug>/05-generate/responsive/ to be populated.
Step 3: Run generate-iac
Follow ALL instructions in skills/generate-iac/SKILL.md.
Pass: --service, --include-unverified if set.
Wait for <slug>/05-generate/iac/ to be populated with all 4 formats.
Step 4: Final Validation
Run the comprehensive validation below.
Final Validation
Final validation runs automatically via PostToolUse hooks (validate_controls.py per-file checks) and Stop hook (validate_cross.py cross-artifact checks X1-X11).
Phase 4 Inventory
After sub-skills finish, print a one-screen inventory of what was generated. This
gives the user (and Summarize) a quick view of category counts and which IaC formats
are actually present. Runs unconditionally — no HITL gate.
python3 - <<'PY'
import json
from pathlib import Path
root = Path(f".service-approval/{slug}/05-generate")
categories = ["preventive", "proactive", "detective", "responsive", "iac"]
counts = {c: sum(1 for _ in (root / c).rglob("*") if _.is_file()) if (root / c).exists() else 0
for c in categories}
iac_formats = {}
iac_root = root / "iac"
if iac_root.exists():
iac_formats["terraform"] = (iac_root / "modules").exists()
iac_formats["cloudformation"] = any(iac_root.glob("*.cfn.yaml")) or any(iac_root.glob("*.yaml"))
iac_formats["cdk-typescript"] = any(iac_root.rglob("*.ts"))
iac_formats["cdktf"] = (iac_root / "cdktf").exists() or any(iac_root.rglob("cdktf.json"))
service = None
sj = Path(f".service-approval/{slug}/03-validate/validated.json")
if sj.exists():
service = json.loads(sj.read_text()).get("service")
formats_present = ", ".join(k for k, v in iac_formats.items() if v) or "(none)"
print(f"Phase 4 complete — {service or '(unknown service)'}:")
for c in categories:
print(f" {c.capitalize():13} {counts[c]} files")
print(f)
PY
Print Summary
Control generation complete (v3):
Sub-skills:
- generate-preventive: preventive/ + proactive/
- generate-detective: detective/ + responsive/
- generate-iac: iac/ (4 formats + {N} TF modules)
Controls matrix:
Org×Proactive: tag-policy, OPA, cfn-guard [, scp-provisioning]
Org×Preventive: scp-policy [, ai-optout]
Org×Detective: config-org-rules, conformance-pack, cloudtrail-org-config
Org×Responsive: ssm-runbook-org
Acc×Proactive: cfn-guard-rules, cfn-hooks-policy, checkov-config, OPA
Acc×Preventive: permission-boundary
Acc×Detective: config-rules, eventbridge-rules, cloudwatch-alarms [, access-analyzer]
Acc×Responsive: lambda-remediator, ssm-runbook, stepfunctions-workflow
Res×Preventive: resource-policy [, kms-key-policy] [, rcp-policy]
Res×Responsive: stepfunctions-workflow (resource-level)
IaC: CDK, CFN, CDKTF + Terraform ({N} modules)
Output: .service-approval/<slug>/05-generate/
