orca-exposure-map

Orca Exposure Map Skill

Answers the question: "What can an attacker see from outside, and what's the easiest way in?"

Maps all internet-facing assets, ranks them by exploitability, groups by attack vector (exposed services, public storage, vulnerable web apps, open management ports), and presents the environment from an attacker's perspective.

Usage

/orca-exposure-map
/orca-exposure-map account 123456789012
/orca-exposure-map web services

Or natural language:

• "what's exposed to the internet?"
• "show me our attack surface"
• "what can an attacker see?"
• "public-facing assets with vulnerabilities"
• "exposed ports and services"

Processing Logic

Step 1: Determine Scope

Parse user input:

• All accounts: no argument → full environment
• Specific account: "account 123456789012" → filter
• Specific vector: "web services" → focus on that category

Step 2: Gather Data (run ALL in parallel)

Run 6 discovery_search queries to cover different exposure types:

Query 1: Internet-facing assets with critical vulns

discovery_search:
  search_phrase: "internet facing assets with critical vulnerabilities"
  limit: 10

Query 2: Publicly accessible storage

discovery_search:
  search_phrase: "publicly accessible S3 buckets or storage with sensitive data"
  limit: 10

Query 3: Exposed management interfaces

discovery_search:
  search_phrase: "internet facing assets with exposed management ports SSH RDP"
  limit: 10

Query 4: Exposed web applications

discovery_search:
  search_phrase: "internet facing web applications with high vulnerabilities"
  limit: 10

Query 5: Exposed databases

discovery_search:
  search_phrase: "internet facing databases or database ports exposed"
  limit: 10

Query 6: Assets with public IPs and critical alerts

discovery_search:
  search_phrase: "public facing assets with critical open alerts"
  limit: 10

Step 3: Enrich High-Risk Assets

For the top 5 most critical exposed assets, run in parallel: