Guide · Agent skill
How to use the Auditing Cloud with CIS Benchmarks agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the auditing-cloud-with-cis-benchmarks agent skill, a set of instructions and helper files that lets an AI agent guide a cloud security audit of AWS, Azure or Google Cloud against the CIS Foundations Benchmarks. It is aimed at cloud and security engineers who may not have used agent skills before. By the end you will know how to install the skill, ask for an audit in plain language, and understand what the agent will and will not do.
Auditing Cloud with CIS Benchmarksmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. Alternatively, upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
- 2Install the scanning tools. Install Python 3 with boto3 and botocore, the AWS CLI, Prowler and/or ScoutSuite, and jq as needed for the clouds you audit.
- 3Set read-only audit access. Configure an AWS CLI profile with read-only audit permissions such as SecurityAudit, and use Reader or Viewer roles for Azure and GCP.
- 4Ask for the audit in plain language. Describe the cloud, the account or subscription, and the CIS benchmark version you want checked.
- 5Run the scans and review the output. Let the agent run Prowler or ScoutSuite, then review the JSON, HTML and CSV reports it produces.
- 6Prioritise and review fixes. Work through failed Level 1 controls first, reviewing each suggested remediation command before applying it.
- 7Schedule ongoing checks. Set up periodic scans or enable the Security Hub, Azure Policy or GCP options described in the skill to watch for drift.
What the skill makes the agent do
The CIS Foundations Benchmarks are widely used checklists of recommended security settings for cloud accounts. This skill tells the agent how to assess an environment against them: it walks through running automated scanners such as Prowler and ScoutSuite, reads the failed checks, ranks them by Level 1 or Level 2 profile and section, and suggests fixes and ongoing compliance monitoring.
The skill also includes a bundled Python script, scripts/agent.py, that runs a few AWS checks directly using boto3: root access keys, root MFA and the password policy. Its reference file also shows boto3 snippets for CloudTrail multi-region trails and VPC flow logs.
Install the skill from the ZIP or the Claude apps
Download the ZIP from this page and choose one of two routes. For Claude Code, unzip it into ~/.claude/skills/ to make it available to you everywhere, or into a project's .claude/skills/ folder to limit it to that project. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
The skill folder contains SKILL.md, scripts/agent.py and references/api-reference.md. Keep the folder structure intact so the agent can find the scripts and reference file.
- Claude Code, all projects: ~/.claude/skills/
- Claude Code, one project: .claude/skills/ inside the project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Install the tools and access the skill needs
The skill assumes you already have the tools below. Its prerequisites recommend read-only access for the audit, not admin rights. Use a separate credential for remediation.
For AWS, the skill suggests the SecurityAudit policy. For Azure, it names the Reader role; for GCP, the Viewer role. Keep audit credentials separate from remediation credentials.
- Python 3 with boto3 and botocore (for scripts/agent.py)
- AWS CLI configured with a profile, for example one with read-only audit access
- Prowler and/or ScoutSuite for the scanning steps
- Azure and GCP read-only roles and CLI tooling if you audit those clouds
- jq for parsing JSON output
Trigger the skill with natural requests
You do not need to type a command to use the skill. Describe the job in plain language and the agent should pick it up from the skill's description. The skill is meant for requests such as a cloud security audit, checking CIS benchmark compliance, or setting up continuous cloud compliance monitoring.
Name the cloud and the benchmark version where you can, because the skill covers CIS v5 for AWS and v4 for Azure and GCP.
- Run a CIS v5 baseline audit on my AWS account using the audit-account profile.
- Check our Azure subscriptions against the CIS v4 benchmark and explain the failed controls.
- Prioritise the failed GCP CIS checks by Level 1 first and suggest fixes.
- Help me set up weekly CIS compliance scans for our cloud accounts.
Example: run an AWS assessment with Prowler
The skill's workflow includes this Prowler command for an AWS CIS v5.0 assessment. It writes JSON, HTML and CSV reports to a dated folder. Review it before running, and replace the profile name with your own.
The skill also includes equivalent Prowler commands for Azure and GCP, and a ScoutSuite example using the cis-5.0 ruleset.
prowler aws \
--compliance cis_5.0_aws \
--profile audit-account \
--output-formats json-ocsf,html,csv \
--output-directory ./cis-audit-$(date +%Y%m%d)Read the failed checks and plan remediation
The skill's jq examples group failed results by check ID and count failed resources, and also calculate a pass rate per section. The workflow asks the agent to fix Level 1 controls first, then Level 2 controls for defence in depth.
Treat the remediation commands in the skill as examples. The source shows fixes such as deleting root access keys, enabling S3 default encryption, creating a multi-region CloudTrail trail and adding a CloudWatch metric filter. Review each one against your environment before running it.
- Parse failed Prowler results with the jq command in the skill, grouped by CheckID
- Compare pass rates by section to find the weakest areas
- Fix Level 1 items before Level 2 items
Set up continuous monitoring
For ongoing checks, the skill covers enabling the CIS v5.0 standard in AWS Security Hub, assigning a CIS benchmark policy initiative in Azure Policy, and scheduling periodic Prowler runs with cron or a CI/CD pipeline. The source includes a weekly cron example. Check the schedule and output path before adding it to a server.
0 2 * * 1 prowler aws --compliance cis_5.0_aws --output-formats csv --output-directory /opt/audits/weekly-$(date +\%Y\%m\%d)What people use it for
- Baselining a newly created AWS account against CIS AWS Foundations Benchmark v5.0 before go-live.
- Preparing evidence that references CIS controls for a SOC 2 or ISO 27001 audit.
- Assessing an acquired Azure or GCP environment to get a measurable starting point.
- Tracking compliance improvement by rerunning the same scans on a schedule.
Frequently asked questions
Is the Auditing Cloud with CIS Benchmarks skill free to use?
The skill is published under the Apache-2.0 licence, as listed on this page. Check the licence file in the download for the full terms before reusing it. The tools it calls, such as Prowler and ScoutSuite, are separate projects with their own licences.
What do I need installed before using this skill?
You need Python 3 with boto3 and botocore for the bundled script, the AWS CLI with a configured profile, Prowler and/or ScoutSuite for scanning, and jq for parsing output. Azure and GCP audits also need read-only roles and their CLI tooling.
Where do I install an agent skill?
Unzip the skill into ~/.claude/skills/ for all your projects, or into a project's .claude/skills/ folder for one project. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
Does the skill fix my cloud automatically?
No. The remediation commands in the skill are examples to review. Applying them to production can break workloads or lock out users, so test changes first and use separate remediation credentials.
Can it detect live attacks?
No. The skill reports configuration state against the benchmarks. The skill itself says runtime threat detection belongs to a different skill, detecting-cloud-threats-with-guardduty.
How does this compare with running Prowler or ScoutSuite myself?
The skill does not replace those scanners. It wraps them with guidance on which CIS version to use, how to read failed checks by severity and profile, and how to plan remediation. If you already know the tools well, you can run their commands directly and use the skill for interpretation.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits cloud or security engineers doing a first CIS baseline on an AWS, Azure or GCP account, and teams gathering evidence for SOC 2 or ISO 27001 audits. It is not a runtime threat detection tool, and it will not fix anything without your review. Only scan accounts you own or have written authorisation to assess, because the tools read sensitive configuration.
Download the skill