菜单
Use when asked about cost impact of a change, "what does this cost", "cost estimate", or "/cost-check". Summarizes the AWS/GCP/cloud cost implications of an infra or code change.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | cost-impact-summary |
| description | Use when asked about cost impact of a change, "what does this cost", "cost estimate", or "/cost-check". Summarizes the AWS/GCP/cloud cost implications of an infra or code change. |
Identify billable resource changes from the plan/diff:
For each changed resource, estimate:
Use rough public pricing. Flag when a precise estimate requires Infracost or AWS Pricing Calculator.
Highlight cost surprises:
Output:
## Cost Impact Summary
| Resource | Change | Est. Monthly Delta |
|---|---|---|
| `aws_instance.app` | t3.medium → t3.large | +$29/mo |
| `aws_nat_gateway` | new | +$32/mo + transfer |
| `aws_rds_instance.main` | db.t3 → db.m5 | +$85/mo |
**Estimated total delta:** +$146/mo
### Watch out for
- NAT Gateway data transfer charges depend on traffic volume — estimate based on X GB/day.
- `aws_rds_instance` upgrade requires a maintenance window.
### For precise numbers
Run: `infracost breakdown --path .`
Or: AWS Pricing Calculator for <resource>
infracost is available in the environment, prefer running it over manual estimation.Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.