Implementing cloud workload protection
Skill pinkpixel-dev/skills-collection-2/SKILLS/implementing-cloud-workload-protection
Part 2 of the AI and agent skills collection, with 650+ skill folders focused on reusable workflows, security playbooks, cloud implementation guides, scripts, references, and assets for builders and operators.
npx -y skills add pinkpixel-dev/skills-collection-2 --skill implementing-cloud-workload-protectionAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anomaly detection, and file integrity checking on EC2/GCE instances. Scans for cryptomining, reverse shells, and unauthorized binaries. Use when building runtime security controls for cloud compute workloads.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.1 KB, as published. Nobody here has run it
Implementing Cloud Workload Protection
When to Use
- When deploying or configuring implementing cloud workload protection capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Familiarity with cloud security concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
Monitor cloud workloads for runtime threats by checking process lists, network connections, file integrity, and resource utilization anomalies.
import boto3
ssm = boto3.client("ssm")
# Run command on EC2 instances to check for suspicious processes
response = ssm.send_command(
InstanceIds=["i-1234567890abcdef0"],
DocumentName="AWS-RunShellScript",
Parameters={"commands": ["ps aux | grep -E 'xmrig|minerd|cryptonight'"]},
)
Key protection areas:
- Process monitoring for cryptominers and reverse shells
- File integrity monitoring on critical system files
- Network connection auditing for C2 callbacks
- Resource utilization anomaly detection (CPU spikes)
- Unauthorized binary detection via hash comparison
Examples
# Check for unauthorized outbound connections
ssm.send_command(
InstanceIds=instances,
DocumentName="AWS-RunShellScript",
Parameters={"commands": ["ss -tlnp | grep ESTABLISHED"]},
)