mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-10 20:33:20 +03:00
Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
This commit is contained in:
mukul975
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2025 Anthropic Agent Skills Contributors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,59 @@
|
||||
# API Reference: Implementing Zero Trust Network Access
|
||||
|
||||
## AWS Verified Access API
|
||||
|
||||
| Operation | Description |
|
||||
|-----------|-------------|
|
||||
| `ec2.create_verified_access_instance()` | Create a Verified Access instance for ZTNA |
|
||||
| `ec2.create_verified_access_trust_provider()` | Register OIDC or device trust provider |
|
||||
| `ec2.create_verified_access_group()` | Create access group with Cedar policy |
|
||||
| `ec2.create_verified_access_endpoint()` | Expose internal app through Verified Access |
|
||||
| `ec2.describe_verified_access_instances()` | List all Verified Access instances |
|
||||
| `ec2.modify_verified_access_instance_logging_configuration()` | Enable CloudWatch or S3 logging |
|
||||
|
||||
## GCP Identity-Aware Proxy API
|
||||
|
||||
| Operation | Description |
|
||||
|-----------|-------------|
|
||||
| `gcloud iap web enable` | Enable IAP on App Engine or backend service |
|
||||
| `gcloud iap web add-iam-policy-binding` | Grant IAP access to users or groups |
|
||||
| `gcloud access-context-manager levels create` | Create device/context access levels |
|
||||
| `compute.backendServices.get()` | Check IAP status on backend services |
|
||||
|
||||
## Azure Conditional Access (MS Graph)
|
||||
|
||||
| Endpoint | Method | Description |
|
||||
|----------|--------|-------------|
|
||||
| `/identity/conditionalAccess/policies` | POST | Create conditional access policy |
|
||||
| `/identity/conditionalAccess/policies/{id}` | PATCH | Update policy conditions or grants |
|
||||
| `/identity/conditionalAccess/namedLocations` | GET | List trusted network locations |
|
||||
|
||||
## AWS Security Groups (Micro-Segmentation)
|
||||
|
||||
| Operation | Description |
|
||||
|-----------|-------------|
|
||||
| `ec2.describe_security_groups()` | Audit ingress/egress rules for open CIDR ranges |
|
||||
| `ec2.authorize_security_group_ingress()` | Add least-privilege ingress rule by source SG |
|
||||
| `ec2.revoke_security_group_ingress()` | Remove overly permissive rules |
|
||||
|
||||
## Key Libraries
|
||||
|
||||
- **boto3**: AWS SDK for Python — Verified Access and EC2 security group APIs
|
||||
- **google-cloud-compute**: GCP Compute client for backend service IAP checks
|
||||
- **azure-identity + azure-mgmt-network**: Azure Private Endpoint management
|
||||
- **msgraph-sdk**: Microsoft Graph SDK for Conditional Access policies
|
||||
|
||||
## Configuration
|
||||
|
||||
| Variable | Description |
|
||||
|----------|-------------|
|
||||
| `AWS_PROFILE` | AWS CLI profile with `ec2:Describe*` and `ec2:Create*` permissions |
|
||||
| `GOOGLE_CLOUD_PROJECT` | GCP project ID for IAP configuration |
|
||||
| `AZURE_TENANT_ID` | Azure AD tenant for Conditional Access policies |
|
||||
|
||||
## References
|
||||
|
||||
- [AWS Verified Access Documentation](https://docs.aws.amazon.com/verified-access/)
|
||||
- [GCP Identity-Aware Proxy](https://cloud.google.com/iap/docs)
|
||||
- [Azure Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/)
|
||||
- [BeyondCorp Enterprise](https://cloud.google.com/beyondcorp-enterprise/docs)
|
||||
@@ -0,0 +1,168 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Zero Trust Network Access (ZTNA) Assessment Agent
|
||||
Evaluates ZTNA readiness across AWS, Azure, and GCP by checking IAP configs,
|
||||
Verified Access endpoints, conditional access policies, and micro-segmentation.
|
||||
"""
|
||||
|
||||
import json
|
||||
import subprocess
|
||||
import sys
|
||||
from datetime import datetime, timezone
|
||||
|
||||
|
||||
def run_cmd(cmd: list[str]) -> dict:
|
||||
"""Execute a shell command and return structured output."""
|
||||
try:
|
||||
result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
|
||||
return {"success": result.returncode == 0, "stdout": result.stdout, "stderr": result.stderr}
|
||||
except Exception as e:
|
||||
return {"success": False, "stdout": "", "stderr": str(e)}
|
||||
|
||||
|
||||
def check_aws_verified_access() -> dict:
|
||||
"""Enumerate AWS Verified Access instances, groups, and endpoints."""
|
||||
findings = {"instances": [], "groups": [], "endpoints": [], "issues": []}
|
||||
|
||||
result = run_cmd(["aws", "ec2", "describe-verified-access-instances", "--output", "json"])
|
||||
if result["success"]:
|
||||
data = json.loads(result["stdout"])
|
||||
for inst in data.get("VerifiedAccessInstances", []):
|
||||
inst_id = inst["VerifiedAccessInstanceId"]
|
||||
trust_providers = inst.get("VerifiedAccessTrustProviders", [])
|
||||
findings["instances"].append({
|
||||
"id": inst_id,
|
||||
"trust_providers": len(trust_providers),
|
||||
"logging_enabled": inst.get("LoggingConfiguration", {}).get("CloudWatchLogs", {}).get("Enabled", False),
|
||||
})
|
||||
if not trust_providers:
|
||||
findings["issues"].append(f"Instance {inst_id} has no trust providers attached")
|
||||
|
||||
result = run_cmd(["aws", "ec2", "describe-verified-access-groups", "--output", "json"])
|
||||
if result["success"]:
|
||||
data = json.loads(result["stdout"])
|
||||
for grp in data.get("VerifiedAccessGroups", []):
|
||||
grp_id = grp["VerifiedAccessGroupId"]
|
||||
has_policy = bool(grp.get("PolicyDocument"))
|
||||
findings["groups"].append({"id": grp_id, "has_policy": has_policy})
|
||||
if not has_policy:
|
||||
findings["issues"].append(f"Group {grp_id} has no access policy defined")
|
||||
|
||||
result = run_cmd(["aws", "ec2", "describe-verified-access-endpoints", "--output", "json"])
|
||||
if result["success"]:
|
||||
data = json.loads(result["stdout"])
|
||||
for ep in data.get("VerifiedAccessEndpoints", []):
|
||||
findings["endpoints"].append({
|
||||
"id": ep["VerifiedAccessEndpointId"],
|
||||
"type": ep.get("EndpointType", "unknown"),
|
||||
"domain": ep.get("ApplicationDomain", ""),
|
||||
"status": ep.get("Status", {}).get("Code", "unknown"),
|
||||
})
|
||||
|
||||
return findings
|
||||
|
||||
|
||||
def check_aws_security_groups_segmentation(vpc_id: str) -> dict:
|
||||
"""Check for overly permissive security groups that undermine micro-segmentation."""
|
||||
findings = {"total_sgs": 0, "overly_permissive": [], "issues": []}
|
||||
|
||||
result = run_cmd([
|
||||
"aws", "ec2", "describe-security-groups",
|
||||
"--filters", f"Name=vpc-id,Values={vpc_id}",
|
||||
"--output", "json"
|
||||
])
|
||||
if not result["success"]:
|
||||
return findings
|
||||
|
||||
data = json.loads(result["stdout"])
|
||||
sgs = data.get("SecurityGroups", [])
|
||||
findings["total_sgs"] = len(sgs)
|
||||
|
||||
for sg in sgs:
|
||||
sg_id = sg["GroupId"]
|
||||
sg_name = sg.get("GroupName", "")
|
||||
for perm in sg.get("IpPermissions", []):
|
||||
for ip_range in perm.get("IpRanges", []):
|
||||
if ip_range.get("CidrIp") == "0.0.0.0/0":
|
||||
port = perm.get("FromPort", "all")
|
||||
findings["overly_permissive"].append({
|
||||
"sg_id": sg_id,
|
||||
"sg_name": sg_name,
|
||||
"port": port,
|
||||
"cidr": "0.0.0.0/0",
|
||||
})
|
||||
findings["issues"].append(
|
||||
f"SG {sg_id} ({sg_name}) allows 0.0.0.0/0 on port {port}"
|
||||
)
|
||||
return findings
|
||||
|
||||
|
||||
def check_gcp_iap_status(project_id: str) -> dict:
|
||||
"""Check GCP Identity-Aware Proxy configuration."""
|
||||
findings = {"iap_enabled_backends": [], "issues": []}
|
||||
|
||||
result = run_cmd([
|
||||
"gcloud", "compute", "backend-services", "list",
|
||||
"--project", project_id, "--format=json"
|
||||
])
|
||||
if result["success"]:
|
||||
backends = json.loads(result["stdout"])
|
||||
for backend in backends:
|
||||
name = backend.get("name", "")
|
||||
iap = backend.get("iap", {})
|
||||
iap_enabled = iap.get("enabled", False)
|
||||
findings["iap_enabled_backends"].append({"name": name, "iap_enabled": iap_enabled})
|
||||
if not iap_enabled:
|
||||
findings["issues"].append(f"Backend service '{name}' does not have IAP enabled")
|
||||
|
||||
return findings
|
||||
|
||||
|
||||
def generate_ztna_report(aws_va: dict, aws_sg: dict, gcp_iap: dict) -> str:
|
||||
"""Generate a ZTNA assessment report."""
|
||||
timestamp = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC")
|
||||
all_issues = aws_va["issues"] + aws_sg["issues"] + gcp_iap["issues"]
|
||||
|
||||
report_lines = [
|
||||
"Zero Trust Network Access Assessment Report",
|
||||
"=" * 50,
|
||||
f"Assessment Date: {timestamp}",
|
||||
"",
|
||||
"AWS Verified Access:",
|
||||
f" Instances: {len(aws_va['instances'])}",
|
||||
f" Access Groups: {len(aws_va['groups'])}",
|
||||
f" Endpoints: {len(aws_va['endpoints'])}",
|
||||
"",
|
||||
"AWS Micro-Segmentation:",
|
||||
f" Security Groups Evaluated: {aws_sg['total_sgs']}",
|
||||
f" Overly Permissive Rules: {len(aws_sg['overly_permissive'])}",
|
||||
"",
|
||||
"GCP Identity-Aware Proxy:",
|
||||
f" Backend Services: {len(gcp_iap['iap_enabled_backends'])}",
|
||||
f" IAP-Enabled: {sum(1 for b in gcp_iap['iap_enabled_backends'] if b['iap_enabled'])}",
|
||||
"",
|
||||
f"Total Issues Found: {len(all_issues)}",
|
||||
"-" * 40,
|
||||
]
|
||||
for i, issue in enumerate(all_issues, 1):
|
||||
report_lines.append(f" [{i}] {issue}")
|
||||
|
||||
return "\n".join(report_lines)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
print("[*] Starting Zero Trust Network Access assessment...")
|
||||
vpc_id = sys.argv[1] if len(sys.argv) > 1 else "vpc-default"
|
||||
gcp_project = sys.argv[2] if len(sys.argv) > 2 else "my-project"
|
||||
|
||||
aws_va = check_aws_verified_access()
|
||||
aws_sg = check_aws_security_groups_segmentation(vpc_id)
|
||||
gcp_iap = check_gcp_iap_status(gcp_project)
|
||||
|
||||
report = generate_ztna_report(aws_va, aws_sg, gcp_iap)
|
||||
print(report)
|
||||
|
||||
output_file = f"ztna_assessment_{datetime.now(timezone.utc).strftime('%Y%m%d_%H%M%S')}.json"
|
||||
with open(output_file, "w") as f:
|
||||
json.dump({"aws_verified_access": aws_va, "aws_segmentation": aws_sg, "gcp_iap": gcp_iap}, f, indent=2)
|
||||
print(f"\n[*] Detailed results saved to {output_file}")
|
||||
Reference in New Issue
Block a user