Cloud security

Skill Rootx202/appsec-skills/cloud-security

AppSec Skills — 15 plug-and-play Claude Code security skills that audit, harden, and fix any website or app before you ship it. OWASP Top 10, auth, API, database, frontend, backend, cloud, dependencies, secrets, and pentest-style checks — all defensive, all evidence-based.

Install

npx -y skills add Rootx202/appsec-skills --skill cloud-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

3 things to look at

23 days oldThe repository was created 23 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Cloud and infrastructure configuration security auditor for Vercel, Netlify, AWS, Azure, Google Cloud, and Supabase/Firebase project settings. Use when reviewing deployment configuration, environment variable management, IAM permissions, storage bucket access, or general cloud misconfiguration — rather than the application code itself.

SKILL.md

2.8 KB, as published. Nobody here has run it

Cloud Security — Infrastructure & Deployment Configuration Auditor

A specialized skill for auditing infrastructure and deployment settings (not application code itself).

When to use this

Reviewing deployment configuration on Vercel/Netlify/AWS/Azure/GCP/Supabase/Firebase
Suspected leakage of environment variables or overly broad IAM permissions
Reviewing file storage bucket access settings

Core Checks

Environment Variables

Real secrets (API keys, connection strings) are never exposed to the client (check that a client-exposed prefix wasn't mistakenly applied to a real secret).
Separate credentials entirely per environment (development/staging/production) — never share the same keys across environments.
.env files with real values are never committed to git (verify .gitignore coverage).

IAM & Permissions (AWS/GCP/Azure)

Principle of least privilege: no service is granted full administrative access (*:* or Owner) when it only needs narrow, specific permissions.
Prefer short-lived/temporary credentials (assumed roles) over long-lived static API keys where possible.
Regular key rotation, and immediate revocation of any leaked key.

File Storage (S3 / Storage Buckets / Supabase Storage / Firebase Storage)

No public buckets holding sensitive data without an explicit, deliberate reason.
Fine-grained access policies instead of blanket public read/write.
Signed, time-limited URLs for sensitive files instead of permanent open links.

Deployment Platform Settings

Preview/staging deployments don't expose real production data or connect directly to the production database.
Deployment webhooks are protected by a signature/shared secret.

Network

No administrative ports (database, SSH, admin dashboards) open to the public internet without necessity.
HTTPS enforced everywhere with automatic redirect from HTTP.

Backups & Recovery

Regular backups of critical data exist, with periodic restore testing.

Report Format

Resource: [service/resource name]
Issue: [problem]
Severity: Critical/High/Medium/Low
Evidence: [current configuration]
Impact: [impact]
Fix: [recommended configuration]

Rules

This skill reviews infrastructure configuration only, not application code (that belongs to the other skills).
Never request or use the user's actual live cloud credentials during review — work only from shared config files or a description of the settings.