Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vinayaklatthe/microsoft-security-skills --skill cloud-app-security-posturegit clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/cloud-app-security-posture)<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/cloud-app-security-posture"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/cloud-app-security-posture/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/cloud-app-security-posture"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/cloud-app-security-posture.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00179 | $0.01909 |
| Opus 5 | $0.00089 | $0.00955 |
| Sonnet 5 | $0.00036 | $0.00382 |
| Haiku 4.5 | $0.00018 | $0.00191 |
Grade A, and why
cloud-app-security-posture scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloud & App Security Posture
Security posture management spans two complementary layers: CSPM for cloud infrastructure (IaaS/PaaS) via Microsoft Defender for Cloud, and SSPM for SaaS applications via Microsoft Defender for Cloud Apps. Together they continuously reduce misconfiguration risk across the cloud and SaaS estate.
When to use
Assessing and continuously hardening configuration posture across both cloud infrastructure and SaaS applications - especially when remediation has stalled or when you cannot answer "what should we fix next?".
Do not use this skill for:
- IaaS/PaaS workload threat protection plans (use
defender-for-cloud-hardening) - SaaS threat detection or shadow-IT discovery only (use
defender-for-cloud-apps) - DSPM for AI (use
purview-dspm-ai)
Pick the right posture lens
| You need to harden... | Use this | Surface |
|---|---|---|
| Azure subscriptions, AWS accounts, GCP projects | Defender for Cloud CSPM | Defender for Cloud → Recommendations |
| Internet-exposed VMs / data with toxic combinations | Defender CSPM (paid) + attack-path | Defender for Cloud → Attack path analysis |
| Microsoft 365, Salesforce, ServiceNow, GitHub config | Defender for Cloud Apps SSPM | Defender XDR → Cloud apps → Posture |
| Container / Kubernetes posture | Defender CSPM container plan | Defender for Cloud → Cloud security graph |
| Code / IaC misconfiguration | DevOps security in Defender for Cloud | Defender for Cloud → DevOps |
| Identity hygiene gaps in the cloud | Identity recommendations (CIEM) | Defender for Cloud + Entra Permissions Mgmt |
Rule of thumb: Foundation CSPM is free with the Defender for Cloud plan and gives you Secure Score + MCSB recommendations. The paid Defender CSPM plan adds attack-path analysis, the cloud security graph, agentless scanning, and DevOps - enable it for any environment where you need to prioritise by exploitability, not by count.
Approach
- Enable foundation CSPM everywhere - Turn on Defender for Cloud across all Azure subscriptions, connect AWS accounts and GCP projects, and confirm Microsoft Cloud Security Benchmark (MCSB) recommendations and Secure Score are populating. Verify: Defender for Cloud → Inventory shows all subscriptions/accounts; Secure Score is non-zero per scope.
- Turn on Defender CSPM (paid) for high-value scopes - Enable the paid plan on subscriptions/accounts holding internet-exposed workloads or sensitive data to unlock attack-path analysis and the cloud security graph. Foundation CSPM alone tells you what is misconfigured; Defender CSPM tells you which misconfigurations form an exploitable chain. Verify: Attack path analysis page lists at least one path; you can trace a path from internet to sensitive data.
- Enable SSPM in Defender for Cloud Apps - Connect each SaaS app (Microsoft 365, Salesforce, ServiceNow, GitHub, Okta, etc.) via API connector. SSPM recommendations cover admin controls, MFA settings, sharing exposure, and inactive privileged users per app. Verify: Defender XDR → Cloud apps → Posture shows recommendations per connected app, not just discovery.
- Prioritise by exposure and impact - Rank remediations by: internet exposure, sensitive data, privileged identity, and attack-path criticality. Use the cloud security graph to group recommendations that break the same path. Verify: top 10 remediation list is not the top 10 by recommendation count but the top 10 by risk-weighted impact.
- Assign owners and SLAs - Recommendations without an owner do not get fixed. Route by workload (subscription tag, resource group, SaaS app owner) into your ticketing system with a remediation SLA based on severity. Verify: ticket count per workload owner is visible; aging report shows median time to close per severity.
- Enforce and automate where safe - Use Azure Policy to prevent regression of fixed configurations (deny new resources without encryption, block public IP creation in tagged scopes). Use Defender for Cloud workflow automation to route recommendations to Logic Apps for auto-remediation where reversible. Verify: at least one Azure Policy denies a previously-common misconfiguration; auto- remediation logs show successful fixes for one recommendation class.
- Monitor drift continuously - Re-baseline as the estate changes (new subscriptions, new SaaS apps, new accounts). Posture is not a one-time project; it is an operating model. Verify: Secure Score trend over 90 days is flat or improving, not erratic.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 124 lines · 179 tokens per session scan A 92622b66612a
cloud-app-security-posture is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (172 stars, last pushed 2mo ago), licensed MIT. It adds 179 tokens to every session and 1,909 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deepspeed
Expert guidance for distributed training with DeepSpeed - ZeRO optimization stages, pipeline parallelism, FP16/BF16/FP8, 1-bit Adam, sparse attention.
agents-sdk-provision
Use when provisioning Azure resources for a Microsoft Agents SDK application — including creating an Azure Bot Service resource, setting up Entra app registrations, configuring identity credentials (UserManagedIdentity, FederatedCredentials, or ClientSecret), adding a Teams channel, running Bicep deployments for SSO…
detecting-azure-service-principal-abuse
Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.
detecting-azure-lateral-movement
Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
aspire
Build, upgrade, and operate Aspire 13.5.x C# or TypeScript application hosts with the current CLI, AppHost, ServiceDefaults, integrations, dashboard, testing, MCP, and deployment patterns for distributed apps. USE FOR: Aspire.AppHost.Sdk, Aspire.Hosting., DistributedApplication.CreateBuilder, apphost.mts…
azure-functions
Build, review, or migrate Azure Functions in .NET with correct execution model, isolated worker setup, bindings, DI, and Durable Functions patterns. USE FOR: working on Azure Functions in .NET; migrating from the in-process model to the isolated worker model; adding Durable Functions, bindings, or host configuration.…