mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-19 22:19:39 +03:00
Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
This commit is contained in:
mukul975
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2025 Anthropic Agent Skills Contributors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,74 @@
|
||||
# API Reference: Building Cloud Security Posture Management
|
||||
|
||||
## boto3 - AWS CSPM Checks
|
||||
|
||||
### S3 Public Access
|
||||
|
||||
```python
|
||||
s3 = boto3.client("s3")
|
||||
pab = s3.get_public_access_block(Bucket="my-bucket")
|
||||
config = pab["PublicAccessBlockConfiguration"]
|
||||
```
|
||||
|
||||
### Unencrypted EBS Volumes
|
||||
|
||||
```python
|
||||
ec2 = boto3.client("ec2")
|
||||
for vol in ec2.describe_volumes()["Volumes"]:
|
||||
if not vol["Encrypted"]:
|
||||
print(f"Unencrypted: {vol['VolumeId']}")
|
||||
```
|
||||
|
||||
### Open Security Groups
|
||||
|
||||
```python
|
||||
for sg in ec2.describe_security_groups()["SecurityGroups"]:
|
||||
for rule in sg["IpPermissions"]:
|
||||
for ip in rule.get("IpRanges", []):
|
||||
if ip["CidrIp"] == "0.0.0.0/0":
|
||||
print(f"OPEN: {sg['GroupId']} port {rule['FromPort']}")
|
||||
```
|
||||
|
||||
### IAM Users Without MFA
|
||||
|
||||
```python
|
||||
iam = boto3.client("iam")
|
||||
for user in iam.list_users()["Users"]:
|
||||
mfa = iam.list_mfa_devices(UserName=user["UserName"])["MFADevices"]
|
||||
if not mfa:
|
||||
print(f"No MFA: {user['UserName']}")
|
||||
```
|
||||
|
||||
### Public RDS Instances
|
||||
|
||||
```python
|
||||
rds = boto3.client("rds")
|
||||
for db in rds.describe_db_instances()["DBInstances"]:
|
||||
if db["PubliclyAccessible"]:
|
||||
print(f"Public RDS: {db['DBInstanceIdentifier']}")
|
||||
```
|
||||
|
||||
## Key CSPM Checks
|
||||
|
||||
| Check | Service | boto3 Method |
|
||||
|-------|---------|-------------|
|
||||
| Public S3 | S3 | `get_public_access_block()` |
|
||||
| Unencrypted EBS | EC2 | `describe_volumes()` |
|
||||
| Open SGs | EC2 | `describe_security_groups()` |
|
||||
| No MFA | IAM | `list_mfa_devices()` |
|
||||
| Public RDS | RDS | `describe_db_instances()` |
|
||||
| CloudTrail | CloudTrail | `describe_trails()` |
|
||||
|
||||
## Steampipe (SQL-Based CSPM)
|
||||
|
||||
```sql
|
||||
select name, region, server_side_encryption_configuration
|
||||
from aws_s3_bucket
|
||||
where server_side_encryption_configuration is null;
|
||||
```
|
||||
|
||||
### References
|
||||
|
||||
- boto3: https://boto3.amazonaws.com/v1/documentation/api/latest/
|
||||
- Prowler: https://github.com/prowler-cloud/prowler
|
||||
- Steampipe: https://steampipe.io/
|
||||
@@ -0,0 +1,158 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Agent for building cloud security posture management across AWS/Azure/GCP."""
|
||||
|
||||
import os
|
||||
import json
|
||||
import argparse
|
||||
from datetime import datetime
|
||||
|
||||
import boto3
|
||||
from botocore.exceptions import ClientError
|
||||
|
||||
|
||||
def check_s3_public_buckets(session):
|
||||
"""Check for publicly accessible S3 buckets."""
|
||||
s3 = session.client("s3")
|
||||
buckets = s3.list_buckets()["Buckets"]
|
||||
findings = []
|
||||
for b in buckets:
|
||||
name = b["Name"]
|
||||
try:
|
||||
pab = s3.get_public_access_block(Bucket=name)
|
||||
config = pab["PublicAccessBlockConfiguration"]
|
||||
if not all([config.get("BlockPublicAcls"), config.get("IgnorePublicAcls"),
|
||||
config.get("BlockPublicPolicy"), config.get("RestrictPublicBuckets")]):
|
||||
findings.append({"bucket": name, "issue": "Incomplete public access block", "severity": "HIGH"})
|
||||
except ClientError:
|
||||
findings.append({"bucket": name, "issue": "No public access block configured", "severity": "HIGH"})
|
||||
return findings
|
||||
|
||||
|
||||
def check_unencrypted_ebs(session):
|
||||
"""Check for unencrypted EBS volumes."""
|
||||
ec2 = session.client("ec2")
|
||||
volumes = ec2.describe_volumes()["Volumes"]
|
||||
unencrypted = [
|
||||
{"volume_id": v["VolumeId"], "state": v["State"], "size_gb": v["Size"]}
|
||||
for v in volumes if not v.get("Encrypted")
|
||||
]
|
||||
return unencrypted
|
||||
|
||||
|
||||
def check_public_security_groups(session):
|
||||
"""Check for security groups allowing unrestricted inbound access."""
|
||||
ec2 = session.client("ec2")
|
||||
sgs = ec2.describe_security_groups()["SecurityGroups"]
|
||||
findings = []
|
||||
dangerous_ports = [22, 3389, 3306, 5432, 1433, 27017]
|
||||
for sg in sgs:
|
||||
for rule in sg.get("IpPermissions", []):
|
||||
for ip_range in rule.get("IpRanges", []):
|
||||
if ip_range.get("CidrIp") == "0.0.0.0/0":
|
||||
from_port = rule.get("FromPort", 0)
|
||||
to_port = rule.get("ToPort", 65535)
|
||||
severity = "CRITICAL" if any(from_port <= p <= to_port for p in dangerous_ports) else "HIGH"
|
||||
findings.append({
|
||||
"sg_id": sg["GroupId"],
|
||||
"sg_name": sg.get("GroupName"),
|
||||
"port_range": f"{from_port}-{to_port}",
|
||||
"source": "0.0.0.0/0",
|
||||
"severity": severity,
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def check_iam_users_without_mfa(session):
|
||||
"""Check for IAM users without MFA enabled."""
|
||||
iam = session.client("iam")
|
||||
users = iam.list_users()["Users"]
|
||||
no_mfa = []
|
||||
for user in users:
|
||||
mfa_devices = iam.list_mfa_devices(UserName=user["UserName"])["MFADevices"]
|
||||
if not mfa_devices:
|
||||
no_mfa.append({"username": user["UserName"], "created": str(user["CreateDate"])})
|
||||
return no_mfa
|
||||
|
||||
|
||||
def check_rds_public_access(session):
|
||||
"""Check for RDS instances with public accessibility."""
|
||||
rds = session.client("rds")
|
||||
instances = rds.describe_db_instances()["DBInstances"]
|
||||
public = [
|
||||
{"instance": db["DBInstanceIdentifier"], "engine": db["Engine"], "endpoint": db.get("Endpoint", {}).get("Address", "")}
|
||||
for db in instances if db.get("PubliclyAccessible")
|
||||
]
|
||||
return public
|
||||
|
||||
|
||||
def check_cloudtrail_enabled(session):
|
||||
"""Check if CloudTrail is enabled with multi-region logging."""
|
||||
ct = session.client("cloudtrail")
|
||||
trails = ct.describe_trails()["trailList"]
|
||||
multiregion = [t for t in trails if t.get("IsMultiRegionTrail")]
|
||||
if not multiregion:
|
||||
return {"status": "FAIL", "detail": "No multi-region CloudTrail found"}
|
||||
return {"status": "PASS", "trails": len(multiregion)}
|
||||
|
||||
|
||||
def calculate_posture_score(findings_summary):
|
||||
"""Calculate an overall security posture score."""
|
||||
total_checks = sum(findings_summary.values())
|
||||
if total_checks == 0:
|
||||
return 100
|
||||
critical = findings_summary.get("critical", 0)
|
||||
high = findings_summary.get("high", 0)
|
||||
medium = findings_summary.get("medium", 0)
|
||||
deductions = (critical * 15) + (high * 8) + (medium * 3)
|
||||
return max(0, 100 - deductions)
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description="Cloud Security Posture Management Agent")
|
||||
parser.add_argument("--profile", default=os.getenv("AWS_PROFILE"))
|
||||
parser.add_argument("--region", default=os.getenv("AWS_DEFAULT_REGION", "us-east-1"))
|
||||
parser.add_argument("--output", default="cspm_report.json")
|
||||
args = parser.parse_args()
|
||||
|
||||
session = boto3.Session(profile_name=args.profile, region_name=args.region)
|
||||
account = session.client("sts").get_caller_identity()["Account"]
|
||||
print(f"[+] CSPM scan for account {account}")
|
||||
|
||||
report = {"account": account, "scan_date": datetime.utcnow().isoformat(), "findings": {}}
|
||||
|
||||
print("[+] Checking S3 bucket public access...")
|
||||
report["findings"]["s3_public"] = check_s3_public_buckets(session)
|
||||
print(f" Issues: {len(report['findings']['s3_public'])}")
|
||||
|
||||
print("[+] Checking unencrypted EBS volumes...")
|
||||
report["findings"]["unencrypted_ebs"] = check_unencrypted_ebs(session)
|
||||
print(f" Unencrypted: {len(report['findings']['unencrypted_ebs'])}")
|
||||
|
||||
print("[+] Checking public security groups...")
|
||||
report["findings"]["public_sgs"] = check_public_security_groups(session)
|
||||
print(f" Open rules: {len(report['findings']['public_sgs'])}")
|
||||
|
||||
print("[+] Checking IAM users without MFA...")
|
||||
report["findings"]["no_mfa_users"] = check_iam_users_without_mfa(session)
|
||||
print(f" Without MFA: {len(report['findings']['no_mfa_users'])}")
|
||||
|
||||
print("[+] Checking public RDS instances...")
|
||||
report["findings"]["public_rds"] = check_rds_public_access(session)
|
||||
print(f" Public: {len(report['findings']['public_rds'])}")
|
||||
|
||||
print("[+] Checking CloudTrail...")
|
||||
report["findings"]["cloudtrail"] = check_cloudtrail_enabled(session)
|
||||
|
||||
critical = sum(1 for f in report["findings"].get("public_sgs", []) if f.get("severity") == "CRITICAL")
|
||||
high = len(report["findings"]["s3_public"]) + len(report["findings"]["no_mfa_users"])
|
||||
medium = len(report["findings"]["unencrypted_ebs"])
|
||||
report["posture_score"] = calculate_posture_score({"critical": critical, "high": high, "medium": medium})
|
||||
print(f"\n[+] Posture Score: {report['posture_score']}/100")
|
||||
|
||||
with open(args.output, "w") as f:
|
||||
json.dump(report, f, indent=2, default=str)
|
||||
print(f"[+] Report saved to {args.output}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user