orca-data-exposure

Orca Data Exposure Skill

Answers the question: "Where is our sensitive data, is it protected, and what's at risk right now?"

Provides a DSPM (Data Security Posture Management) view: discovers sensitive data across the environment (secrets, PII, credentials, API keys, financial data), identifies unprotected or exposed data stores, ranks data risks by exposure level, and generates a remediation plan to secure the most critical data first.

Usage

/orca-data-exposure
/orca-data-exposure secrets
/orca-data-exposure account 123456789012

Or natural language:

• "where's our sensitive data?"
• "find exposed API keys"
• "what PII is at risk?"
• "data exposure report"
• "show me unprotected data stores"
• "DSPM summary"

Processing Logic

Step 1: Determine Scope

Parse user input:

• All data types: no argument → full DSPM view
• Specific type: "secrets" / "PII" / "credentials" / "API keys" → filter
• Account-specific: "account 123456789012" → filter by account
• Asset-specific: "data on bastion-admin" → filter by asset

Step 2: Gather Data (run ALL in parallel)

Run 6 discovery_search queries covering different data exposure categories:

Query 1: Exposed secrets and credentials

discovery_search:
  search_phrase: "exposed secrets credentials API keys passwords"
  limit: 10

Query 2: PII exposure

discovery_search:
  search_phrase: "sensitive data PII personally identifiable information exposed"
  limit: 10

Query 3: Unencrypted data stores

discovery_search:
  search_phrase: "unencrypted S3 buckets databases storage with sensitive data"
  limit: 10

Query 4: Public data stores with sensitive content

discovery_search:
  search_phrase: "publicly accessible storage buckets with sensitive data or secrets"
  limit: 10

Query 5: Sensitive data on internet-facing assets

discovery_search:
  search_phrase: "internet facing assets with sensitive data or secrets"
  limit: 10

Query 6: Certificate and key exposure

discovery_search:
  search_phrase: "exposed private keys certificates TLS SSL"
  limit: 10