菜单
Use when reviewing cloud network design across AWS VPC, Azure VNet, or GCP VPC — security groups, NSGs, firewall rules, peering, private endpoints — or "/network-review". Flags over-broad ingress, missing egress controls, and cross-cloud connectivity risks.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.
| name | cloud-network-review |
| description | Use when reviewing cloud network design across AWS VPC, Azure VNet, or GCP VPC — security groups, NSGs, firewall rules, peering, private endpoints — or "/network-review". Flags over-broad ingress, missing egress controls, and cross-cloud connectivity risks. |
| tools | ["cursor","claude","copilot"] |
gcloud describing the network, ORaws ec2 describe-…, az network …, gcloud compute networks ….Map the topology. Capture VPC/VNet CIDRs, subnets (public/private), route tables, gateways (IGW/NAT/VGW, NAT/Bastion, Cloud NAT/Cloud Router), peering, transit gateway / vWAN / Network Connectivity Center, VPN/ExpressRoute/Interconnect, private endpoints.
Audit ingress (per-cloud equivalents):
| Cloud | Construct | Red flags |
|---|---|---|
| AWS | Security Group, NACL | 0.0.0.0/0 on 22/3389/3306/5432; -1 (all protocols) from anywhere |
| Azure | NSG, Application Security Group | Internet source on management ports; * source/dest with Allow |
| GCP | VPC firewall rule | 0.0.0.0/0 source on SSH/RDP; --allow=all; tag-based rules with broad tags |
Audit egress. Egress-by-default is common — flag when unrestricted egress is unnecessary (PCI / regulated). Recommend egress allow-lists via NAT + firewall rules, Azure Firewall, or Cloud NAT + VPC firewall egress rules.
Audit private connectivity:
Audit data exfiltration controls:
Audit logging:
Deny at minimum.Audit DDoS / WAF posture for any public ingress: AWS Shield + WAF, Azure DDoS Protection + Front Door/App Gateway WAF, Cloud Armor.
Report:
## Cloud Network Review — <env / account / project>
**Cloud(s):** AWS | Azure | GCP
**Verdict:** safe | needs-changes | high-risk
### Topology summary
- 1 VPC / 6 subnets (3 public, 3 private), NAT GW in az-a only (single point of failure).
### High-risk findings
- SG `sg-…` allows `0.0.0.0/0` on tcp/22 — restrict to bastion CIDR.
- NSG `nsg-app` has `*` source `Allow` on 1433.
### Medium-risk findings
- No VPC endpoints for S3 / KMS — traffic egresses NAT GW (cost + exfil risk).
- VPC Flow Logs disabled on `vpc-prod`.
### Recommendations
- [ ] Add a second NAT GW in az-b for HA.
- [ ] Replace `0.0.0.0/0` SSH ingress with Session Manager / Bastion / IAP.
- [ ] Enable Flow Logs to a central log account / workspace.
- [ ] Add VPC Service Controls perimeter around BigQuery / GCS (GCP).
aws ec2 authorize-security-group-ingress, az network nsg rule create, gcloud compute firewall-rules create/update/delete) — review only.0.0.0.0/0 ingress is intentional (public web tier), confirm there's a WAF / DDoS layer in front before downgrading the finding.