菜单
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.
Use when designing a new HTTP/GraphQL API endpoint, evolving an existing one, writing or reviewing an OpenAPI / GraphQL schema, or "/design-api". Produces a contract-first design with request/response shapes, error model, and versioning notes before any code is written.
基于 SOC 职业分类
| name | cloud-posture-scan |
| description | Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation. |
| tools | ["cursor","claude","copilot"] |
aws, az, gcloud) with read-only creds.prowler (recommended), scout-suite, cloudsplaining.prowler (now multi-cloud) or scout-suite.prowler or scout-suite.checkov, tfsec, kics against your Terraform/Bicep/CFN.Confirm scope:
aws sts get-caller-identity
az account show --query '{name:name, id:id}'
gcloud config get-value project
Run the scanner (read-only, may take 5–30 min):
AWS — Prowler v4:
prowler aws --severity critical high --output-formats json-ocsf html
Optional: --compliance cis_2.0_aws, --checks-folder for custom.
Azure — Prowler:
prowler azure --az-cli-auth --severity critical high
GCP — Prowler:
prowler gcp --severity critical high
IaC pre-deploy:
checkov -d . --framework terraform --quiet --compact
tfsec . --minimum-severity HIGH
Triage by exploitability, not just severity:
| Finding | Treat as |
|---|---|
| Public S3/Blob/GCS bucket with read access + sensitive data | CRITICAL |
| RDS / SQL DB publicly accessible (0.0.0.0/0 SG) | CRITICAL |
IAM user with *:* and active access keys, no MFA | CRITICAL |
| Root account access keys exist | CRITICAL |
Security group 0.0.0.0/0 on 22 / 3389 / 1433 / 3306 / 5432 | HIGH |
| KMS key without rotation; unencrypted EBS/disk on prod | HIGH |
| CloudTrail / Activity Log / Audit Log disabled or single-region | HIGH |
| Public AMI / image / snapshot | HIGH |
| MFA not enforced for IAM users / Entra users | HIGH |
| Missing tags / drift / unused resources | LOW (cost, not security) |
Cross-link with IAM review — for any over-privileged principal flagged, trigger aws-iam-policy-review / azure-rbac-review / gcp-iam-review to deep-dive.
Cross-link with network review — for any 0.0.0.0/0 finding, trigger cloud-network-review.
## Cloud posture scan — <provider> <account/sub/project>
**Account:** <id> (<name>)
**Tool:** prowler 4.x | checkov 3.x
**Compliance frame:** CIS AWS 2.0 | CIS Azure 2.0 | CIS GCP 2.0
**Date:** <YYYY-MM-DD>
**Findings:** Critical: N, High: N, Medium: N
### Critical (24h SLA)
#### [CRITICAL] S3 bucket `prod-customer-exports` publicly readable
- **Resource:** `arn:aws:s3:::prod-customer-exports`
- **Why:** ACL grants `AllUsers READ`; bucket contains CSV exports of customer records.
- **Fix:**
aws s3api put-public-access-block --bucket prod-customer-exports
--public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"
aws s3api put-bucket-acl --bucket prod-customer-exports --acl private
- **Detection going forward:** enable `s3-bucket-public-read-prohibited` AWS Config rule.
- **References:** CIS AWS 2.1.5, CWE-732.
#### [CRITICAL] IAM user `legacy-deploy` has `*:*` policy + 2 active access keys + no MFA
- **Fix:** rotate keys, scope to needed actions, enable MFA, OR migrate to IAM Roles + STS.
### High …
### Medium …
### Compliance summary
- CIS AWS 2.0: 47 / 60 passed (78%)
- Top failing controls: 1.4 (root keys), 2.1.5 (S3 public), 4.1 (CloudTrail multi-region).
### Recommended next steps
- [ ] Enable AWS Security Hub + Config aggregator (continuous posture).
- [ ] Add `checkov` to Terraform CI to prevent regressions.
- [ ] Schedule monthly prowler run with diff vs last report.