Guide · Agent skill
How to use the Cloud Security Posture Checker agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The cloud-security skill gives an AI agent a method and a bundled Python script for checking cloud configuration files for misconfigurations: IAM privilege escalation paths, public S3 storage, and risky security group rules. It is aimed at engineers, cloud admins and security reviewers who want to find these problems before deployment. After this guide you will know what the skill does, how to install it, how to ask for a check in plain language, and what its limits are.
Cloud Security Posture Checkeralirezarezvani/claude-skills · MIT Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it. The folder should contain SKILL.md, scripts/cloud_posture_check.py and references/cspm-checks.md.
- 2Place the skill folder. Put it in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills instead.
- 3Export your configuration. Export the IAM policies, S3 bucket configuration or security group rules you want checked as JSON files.
- 4Ask for a check. Describe the review you want in plain language, such as checking an IAM policy for privilege escalation, and name the file.
- 5Run the script if needed. Run scripts/cloud_posture_check.py with --check set to iam, s3, sg or all, and add --json for structured output.
- 6Act on the exit code. Use 0, 1 or 2 to decide next steps: no action, remediate within 24 hours, or remediate immediately and escalate if active.
What the cloud-security skill makes the agent do
An agent skill is a folder of instructions and supporting files that an AI agent loads when a task matches the skill's description. This one covers cloud security posture management (CSPM): checking configuration for settings that could be exploited. It is preventive. It assesses configuration before any exploitation, and it is not meant for responding to an active breach.
Once installed, the agent can review cloud configuration files you supply in JSON, such as IAM policies, S3 bucket settings and security group rules. It looks for settings that could let an attacker escalate privileges, expose storage publicly, or open risky network ports. It maps findings to MITRE ATT&CK techniques and suggests least-privilege fixes.
- IAM: privilege escalation patterns such as iam:PassRole combined with lambda:CreateFunction, and wildcard grants like Action * on Resource *
- S3: public access block settings, bucket ACLs, bucket policy principals and default encryption
- Security groups: inbound rules exposing SSH (22), RDP (3389) or all traffic to internet CIDRs
How do you install the cloud-security skill?
Download the skill as a ZIP file from this page and unzip it. Then place the folder in one of these locations, depending on how you want to use it. For a personal setup, put it in ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.
If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills rather than copying files by hand.
- Personal use: ~/.claude/skills/
- Single project: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills
How do you trigger the skill with natural requests?
You do not need a special command. The skill's description tells the agent when to use it: assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Ask for one of those things in ordinary language and name the file you want reviewed.
Requests that work well name the check type and attach the exported configuration. Mention the provider if it matters, since the skill covers AWS, Azure and GCP, although the bundled script is described as AWS-focused.
- Review this IAM policy for privilege escalation paths before I deploy it.
- Check this S3 bucket configuration for public access and encryption gaps.
- Look at these security group rules and flag any open admin ports.
- Find IaC security gaps in this Terraform-exported JSON.
How do you run the bundled posture check script?
The bundled script scripts/cloud_posture_check.py runs three check types: iam for privilege escalation, s3 for public access, and sg for network exposure. It detects the type from the file structure or accepts an explicit --check flag. Add --json to get structured output. The examples below are the ones given in the skill.
The script can also run all checks with a severity modifier. internet-facing bumps severity for exposed resources, and regulated-data bumps severity by one level for all findings.
python3 scripts/cloud_posture_check.py policy.json --check iam --json
python3 scripts/cloud_posture_check.py bucket_config.json --check s3 --json
python3 scripts/cloud_posture_check.py sg.json --check sg --json
python3 scripts/cloud_posture_check.py config.json --check all --provider aws --severity-modifier internet-facing --json
python3 scripts/cloud_posture_check.py config.json --check all --severity-modifier regulated-data --jsonWhat do the exit codes mean in a pipeline?
The script returns an exit code you can use in scripts or CI pipelines. Code 0 means no high or critical findings. Code 1 means high-severity findings, which the skill says to remediate within 24 hours. Code 2 means critical findings, which should be remediated immediately and escalated to incident-response if the problem is an active compromise.
You can also pipe a live IAM policy from the AWS CLI. This needs the AWS CLI and jq, and it is the only example that uses them.
- 0: no high or critical findings, no action required
- 1: high-severity findings, remediate within 24 hours
- 2: critical findings, remediate immediately
aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/MyPolicy \
--version-id v1 | jq '.PolicyVersion.Document' | \
python3 scripts/cloud_posture_check.py - --check iam --jsonWhat do you need before you start?
You need Python 3 and exported cloud configuration files in JSON. These are IAM policies, S3 bucket configuration and security group rules. The skill only analyses the files you supply. The AWS CLI and jq are needed only if you pipe live policies from AWS as shown in the examples.
The skill runs scripts and does not use the network, according to its listing. Its reference file references/cspm-checks.md holds the full check matrices with severity, MITRE technique and remediation for each check.
- Python 3
- Cloud configuration exported as JSON
- AWS CLI and jq (only for live AWS piping)
What are the safety notes and limits?
The skill runs a bundled Python script on your machine, so review the script before you use it in a sensitive environment. It does not use the network. Its output is not a complete audit. It only analyses the files you give it, and the script is described as AWS-focused, with Azure and GCP described as stubs.
Do not use this skill for active cloud incidents or application vulnerability scanning. The skill itself sends active compromises to a separate incident-response skill, and web application testing belongs to a security-pen-testing skill.
- Runs scripts: yes. Read the script before running it on production exports.
- Uses network: no.
- Output covers only the files you supply, not your whole account.
- Azure and GCP coverage is limited to stubs in the bundled script.
What people use it for
- Reviewing an IAM policy before deployment to catch iam:PassRole combinations that could allow privilege escalation.
- Running a repeatable check on S3 bucket public access block settings and default encryption.
- Triaging security group rules to find SSH or RDP open to the internet.
- Adding the script to a pipeline and using its exit codes to block risky changes.
Frequently asked questions
How do I install the cloud-security agent skill?
Download the ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
Is the cloud-security skill free?
The skill is published under the MIT licence, as listed on this page. Check the licence file in the repository for the full terms before you reuse it.
What do I need to run the cloud-security skill?
You need Python 3 and cloud configuration exported as JSON, such as IAM policies, S3 bucket settings and security group rules. The AWS CLI and jq are only needed if you pipe live policies from AWS.
Does the cloud-security skill work with Azure and GCP?
The skill's description covers AWS, Azure and GCP posture assessment. However, the bundled script is described as AWS-focused, with Azure and GCP as stubs, so expect the most complete results for AWS files.
Can the skill fix or respond to an active cloud breach?
No. It is preventive and assesses configuration before exploitation. For an active cloud compromise, the skill directs you to a separate incident-response skill.
How is this different from a web application vulnerability scanner?
This skill reviews cloud configuration files for misconfigurations. Application vulnerability scanning and exploitation belong to a different skill, security-pen-testing.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you want an agent to review IAM policies, S3 settings and security group rules in JSON before deployment, and to get a repeatable script with exit codes for pipelines. Pick something else if you need an active incident response, web application testing, or a full audit of a live cloud account, since the skill only analyses the files you give it.
Download the skill