iac security scan skills for your AI workflows
This repository also configures its own agents. See what iac-security-scan-skills tells them →
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Foundational repository intelligence. Maps IaC architecture, environments, exposure, and trust boundaries. Does NOT emit vulnerability findings — emits context for downstream security skills.
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Cross-skill attack chain correlation engine. Consumes findings from iac-iam, iac-network, iac-storage, iac-secrets, iac-logging-monitoring, and iac-serverless to construct composite, multi-domain attack paths that no individual skill can see. Identifies internet-to-admin compromise paths, ransomware propagation…
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Single-pass, token-optimized IaC security scan. Covers all 6 domains in one file. Use instead of individual skills when running "Run fast IaC scan".
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Deep IAM and identity-layer security analysis for Infrastructure-as-Code. Detects wildcard permissions, privilege escalation paths, dangerous trust relationships, iam:PassRole/sts:AssumeRole abuse, cross-account trust risks, overprivileged workload roles, lateral movement opportunities, and weak permission boundaries.…
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Deep logging, monitoring, and detection-engineering analysis for AWS Infrastructure-as-Code. Detects missing CloudTrail / GuardDuty / Security Hub / Detective coverage, disabled VPC Flow Logs, absent ALB / WAF / S3 / Route53 / RDS / Lambda / API Gateway / ECS / EKS audit logging, weak log retention, public/unencrypted…
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Deep network-layer security analysis for Infrastructure-as-Code. Detects public exposure, unrestricted ingress/egress, internet-facing workloads, exposed management ports, flat networks, weak segmentation, insecure VPC design, dangerous routing, public databases, exposed internal services, insecure load balancer…
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Lightweight report engine. Reads all skill results, deduplicates, prioritizes, and outputs findings as terminal table + CSV + HTML. No remediation.
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Secrets and credentials analysis for IaC and CI/CD. Detects hardcoded keys, plaintext env vars, state file risks. Contextual validation — not regex-only. Correlates with IAM, network, storage. No remediation.
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Serverless security analysis for AWS IaC. Detects insecure Lambda/API Gateway/Function URL exposure, overprivileged execution roles, event injection, privilege escalation via orchestration, denial-of-wallet, and serverless persistence. No remediation.
senaykt/iac-security-scan-skills
Skill Claude CodeCodex
Deep storage and data security analysis for AWS Infrastructure-as-Code. Detects unencrypted data stores, public S3 buckets, missing backup/DR posture, dangerous access patterns, ransomware readiness gaps, data classification issues, and storage-layer attack surfaces. Consumes structured output from iac-analysis and…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: