orcasecurity

orcasecurity/orca-skills

Plugin Claude Code

Skills and plugins to accelerate security workflows with the Orca Cloud Platform.

orcasecurity/orca-skills

Plugin Claude Code

Skills and plugins to accelerate security workflows with the Orca Cloud Platform.

orcasecurity/orca-skills

Skill Claude CodeCodex

Cloud account coverage and sync-health audit — lists every connected cloud account, sync status, scanner deployment, integration health, and flags blind spots before any audit, investigation, or security review. Use when user asks about coverage, account health, sync status, scanner deployment, "are we monitoring X"…

orcasecurity/orca-skills

Skill Claude CodeCodex

Analyzes Orca Security alerts with timeline visualization, risk assessment, and progressive disclosure. Use when user asks to triage, analyze, explain, summarize, investigate, or check an Orca alert by ID (e.g., "triage orca-3636513", "what is alert orca-3548863", "check orca-3636513").

orcasecurity/orca-skills

Skill Claude CodeCodex

Full 360° security profile of any cloud asset — alerts, attack paths, compliance, permissions, exposure, sensitive data, and CDR activity in one view. Use when user asks about an asset's security posture or profile (e.g., "asset profile for web-bastion-host", "tell me about WEB-PRD", "security posture of", "show me…

orcasecurity/orca-skills

Skill Claude CodeCodex

Cloud cost optimization analysis using Orca Security asset data. Discovers all cloud assets (AWS, GCP, Azure) through Orca MCP tools, compares current configurations against cheaper alternatives using live public pricing, and produces a prioritized cost reduction report with exact asset evidence. Use when the user…

orcasecurity/orca-skills

Skill Claude CodeCodex

Deep-dive compliance gap analysis for any framework — failing controls ranked by impact, quick wins, account breakdown, and remediation plan. Use when user asks about compliance gaps, failures, or status (e.g., "compliance gaps", "PCI DSS status", "where are we failing", "SOC 2 compliance", "quick wins").

orcasecurity/orca-skills

Skill Claude CodeCodex

Traces any Orca alert back to who deployed it, what tool was used, what introduced the issue, and a full timeline of events. Use when user asks about origin, deployment, or ownership of an alert (e.g., "who created this", "where did this come from", "trace back orca-3380725", "who deployed", "what tool was used").

orcasecurity/orca-skills

Skill Claude CodeCodex

Creates custom compliance frameworks from existing frameworks, alert lists, or security themes — organizes controls into sections, maps alerts, and pushes the framework to Orca. Suggests creating custom discovery alerts for gaps not covered by existing rules. Use when user asks to create, build, or generate a custom…

orcasecurity/orca-skills

Skill Claude CodeCodex

CVE blast-radius analysis — given a single CVE-ID, find every affected asset across all accounts, rank by real exposure (internet-facing, attack-path participant, crown jewel) instead of static CVSS. Use when user asks about a specific CVE's environmental impact (e.g., "blast radius of CVE-2024-1234", "where are we…

orcasecurity/orca-skills

Skill Claude CodeCodex

DSPM view — sensitive data at risk across the environment, exposed secrets/PII/credentials, data store security posture, and remediation priorities. Use when user asks about data exposure, sensitive data, or secrets (e.g., "data exposure", "where is our PII", "sensitive data at risk", "exposed secrets", "DSPM view").

orcasecurity/orca-skills

Skill Claude CodeCodex

External attack surface mapping — internet-facing assets ranked by risk, exposed ports/services, and attacker's-eye view of the environment. Use when user asks about attack surface, exposure, or external view (e.g., "exposure map", "attack surface", "what's exposed", "internet-facing", "external view").

orcasecurity/orca-skills

Skill Claude CodeCodex

Analyzes any cloud identity for overprivileged access, actual usage patterns, lateral movement risk, and least-privilege recommendations. Use when user asks about identity permissions, overprivileged access, or IAM review (e.g., "identity review for anika", "is this role overprivileged", "review permissions", "IAM…

orcasecurity/orca-skills

Skill Claude CodeCodex

Analyzes the full impact of fixing an Orca alert — what closes, what breaks, and what the environment looks like after the fix. Use when user asks about impact, consequences, or blast radius of fixing an alert (e.g., "what's the impact of fixing orca-3380725", "if I fix this what breaks", "what else closes").

orcasecurity/orca-skills

Skill Claude CodeCodex

Inactive-identity cleanup - finds inactive identities (users, groups, and non-human identities) across an account, business unit, or tag in every cloud provider Orca supports (AWS, Azure incl. Entra ID, GCP incl. Google Workspace, Alibaba Cloud, OCI, Tencent Cloud), ranks them by identity risk score (highest risk…

orcasecurity/orca-skills

Skill Claude CodeCodex

CDR-powered incident investigation — traces actor activity, builds session timelines, maps MITRE ATT&CK techniques, and assesses blast radius from cloud audit logs. Use when user asks to investigate activity, trace an actor, or analyze an incident (e.g., "investigate bastion-admin", "trace activity", "what did anika…

orcasecurity/orca-skills

Skill Claude CodeCodex

Diagnoses Kubernetes Connector (K8s Tunnel Client / Helm chart orca-tunnel) install and connectivity failures from raw customer input — error text, helm status, kubectl describe, or pod logs — and walks through step-by-step remediation. Use when a user reports the K8s Connector won't install, won't connect, keeps…

orcasecurity/orca-skills

Skill Claude CodeCodex

Daily security briefing summarizing new critical alerts, attack paths, compliance drift, exposure changes, and aging unactioned alerts from the last 24-72 hours. Use when user asks for a briefing, summary, or overview (e.g., "morning briefing", "what happened", "security summary", "daily report", "what needs…

orcasecurity/orca-skills

Skill Claude CodeCodex

Over-privileged identity right-sizing - finds identities holding more permissions than they use, per Orca's pre-computed PoLP (Principle of Least Privilege) recommendations, across an account, business unit, or tag in AWS, Azure, and GCP. Use when the user wants to right-size over-privileged identities, reduce excess…

orcasecurity/orca-skills

Skill Claude CodeCodex

Supply chain exposure check — given a list of suspect packages (e.g. an MDR advisory like the @antv/ npm campaign), find which versions are deployed across the environment, which match the vulnerable range, and which assets carry them. Use when user asks about supply chain risk, package exposure, IOC package check…