Agent skill · security · jeremylongshore
finding-security-misconfigurations
Configure identify security misconfigurations in infrastructure-as-code,
Why this skill is useful
Adds executable scripts for auditing security misconfigurations in infrastructure-as-code and application settings, which are not commonly found in public documentation.
What it needs
Requires checkov, tfsec, trivy installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Finding Security Misconfigurations Overview Scan infrastructure-as-code templates, application configuration files, and system settings to detect security misconfigurations mapped to OWASP A05:2021 (Security Misconfiguration) and CIS Benchmarks. Cover cloud resources (AWS, GCP, Azure), container orchestration (Kubernetes, Docker), web servers (Nginx, Apache), and application frameworks. Prerequisites Infrastructure-as-code files accessible in ${CLAUDESKILLDIR}/ (Terraform .tf, CloudFormation .yaml/.json, Ansible playbooks, Kubernetes manifests) Application configuration files available (application.yml, config.json, .env.example, web.config) Container definitions (Dockerfile, docker-compose.yml, Helm charts) Web server configs (nginx.conf, httpd.conf, .htaccess) if applicable Write permissions for findings output in ${CLAUDESKILLDIR}/security-findings/ Optional: tfsec, checkov, or trivy config installed for automated pre-scanning Instructions 1. Discover all configuration files by scanning ${CLAUDESKILLDIR}/ for IaC templates (.tf, .yaml, .json, .template), application configs, container definitions, and web server configs. 2. Cloud storage: check for publicly accessible S3 buckets, unencrypted storage accounts, missing versioning, and overly permissive bucket policies (CIS AWS 2.1.1, 2.1.2). 3. Network security: flag security groups allowing 0.0.0.0/0 ingress on sensitive ports (22, 3389, 3306, 5432, 27017), missing VPC flow logs, and absent network segmentation. 4. IAM and access: detect wildcard () permissions in IAM policies, service accounts with admin privileges, missing MFA enforcement, and hardcoded credentials in source (CWE-798). 5. Compute resources: identify EC2/VM instances with unnecessary public IPs, unencrypted volumes, missing IMDSv2 enforcement, and outdated base images. 6. Database security: flag publicly accessible RDS/Cloud SQL instances, missing encryption at rest, disabled automated backups, default ports exposed without IP restrictions. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/finding-security-misconfigurations--dae627