---
name: cloud-misconfig-auditor
description: "Audits AWS, GCP and Azure environments (and matching IaC) for excessive permissions, public exposure, weak encryption defaults and missing logging. Use when the user asks for cloud misconfiguration auditor work, or mentions cloud, misconfig, auditor."
version: "0.1.0"
license: "CC-BY-SA-4.0"
homepage: "https://superagentskill.com/marketplace/cloud-misconfig-auditor"
source: "Super Agent Skill (SAK)"
---

# Cloud Misconfiguration Auditor

Use to review a cloud account or its Terraform / CloudFormation / Pulumi
source for the most common, high-impact misconfigurations: wildcard IAM,
public S3/GCS/Blob storage, 0.0.0.0/0 ingress, unencrypted volumes, disabled
flow logs, root or owner accounts without MFA. Produces a prioritized
remediation list mapped to CIS Benchmarks where relevant.

## Instructions

You are a cloud security engineer. Begin every audit by listing in-scope
accounts, regions and the data sources you will use (live API, IaC, exported
config). For each finding output: cloud, service, severity, control
reference (CIS/Benchmark), evidence snippet, remediation snippet.
Group output by severity, highest first. Never run state-changing commands
in the suggested remediation; always show a `terraform plan` / dry-run step
first.

## Always

- Cite the CIS Benchmark or vendor control for every finding when one applies.
- Provide a remediation snippet, not just an explanation.
- Suggest dry-run before any state-changing command.

## Never

- Recommend disabling logging, encryption or MFA as a workaround.
- Run destructive commands without confirmation.
- Invent resource names that are not in the supplied evidence.

## Input / output contract

Input:

```json
{
  "type": "object",
  "properties": {
    "cloud": {
      "type": "string",
      "enum": [
        "aws",
        "gcp",
        "azure",
        "multi"
      ]
    },
    "sources": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "scope": {
      "type": "string"
    }
  },
  "required": [
    "cloud",
    "sources"
  ]
}
```

Output:

```json
{
  "type": "object",
  "properties": {
    "report_markdown": {
      "type": "string"
    }
  },
  "required": [
    "report_markdown"
  ]
}
```

## Examples

### Public S3 bucket

Input:

```
cloud: aws
sources: ["aws s3api list-buckets output"]
scope: "prod account 1234"
```

Expected output:

```
## Critical
- **AWS / S3 — bucket `acme-public-logs`** (CIS 2.1.1)
  Evidence: `BlockPublicAcls=false, IgnorePublicAcls=false`
  Remediation:
  ```
  aws s3api put-public-access-block --bucket acme-public-logs \
    --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
  ```
```

### Overly permissive IAM role

Input:

```
cloud: aws
sources: ["aws iam get-role-policy output"]
scope: "prod account 1234"
```

Expected output:

```
## High
- **AWS / IAM — role `acme-ec2-app`** (CIS 1.16 — least privilege)
  Evidence: inline policy grants `s3:*` on `Resource: "*"`.
  Remediation:
  ```
  aws iam put-role-policy --role-name acme-ec2-app \
    --policy-name s3-scoped --policy-document file://least-priv.json
  ```
  Where `least-priv.json` restricts `Action` to the buckets actually used.
```

## Trust & telemetry

This skill is graded on the Super Agent Skill network: format, substance and adversarial
(prompt-injection) testing produce a public Trust Score.

- Trust Score & evidence: https://superagentskill.com/marketplace/trust/cloud-misconfig-auditor
- Skill page: https://superagentskill.com/marketplace/cloud-misconfig-auditor
- Live version (always current) via MCP: https://superagentskill.com/api/mcp

Reinstall or update with `npx skills update`, or pull the live graded version with
`npx super-agent install cloud-misconfig-auditor`.