Finding Security Misconfigurations

'Configure identify security misconfigurations in infrastructure-as-code, application settings, and system configurations. Use when you need to audit Terraform/CloudFormation templates, check application config files, validate system security settings, or ensure compliance with security best practices. Trigger with phrases like "find security misconfigurations", "audit infrastructure security", "check config security", or "scan for misconfigured settings". '

thedixitjain 457120e 7 files · 11.9 KB Updated Sep 9, 2026 2 repo stars

Install

Press C to copy

$ npx skillmds add thedixitjain/finding-security-misconfigurations

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

＋ Add to collection

README badge

[![SkillMD](https://skillmd.com/badge/thedixitjain/finding-security-misconfigurations.svg)](https://skillmd.com/skills/thedixitjain/finding-security-misconfigurations)

Trust & safety

Audits pending

Not yet audited · commit 457120e

Permissions this skill uses

Makes network calls
The instructions fetch remote URLs or call external services.

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Finding Security Misconfigurations

Overview

Scan infrastructure-as-code templates, application configuration files, and system settings to detect security misconfigurations mapped to OWASP A05:2021 (Security Misconfiguration) and CIS Benchmarks. Cover cloud resources (AWS, GCP, Azure), container orchestration (Kubernetes, Docker), web servers (Nginx, Apache), and application frameworks.

Prerequisites

Infrastructure-as-code files accessible in ${CLAUDE_SKILL_DIR}/ (Terraform .tf, CloudFormation .yaml/.json, Ansible playbooks, Kubernetes manifests)
Application configuration files available (application.yml, config.json, .env.example, web.config)
Container definitions (Dockerfile, docker-compose.yml, Helm charts)
Web server configs (nginx.conf, httpd.conf, .htaccess) if applicable
Write permissions for findings output in ${CLAUDE_SKILL_DIR}/security-findings/
Optional: tfsec, checkov, or trivy config installed for automated pre-scanning

Instructions

Discover all configuration files by scanning ${CLAUDE_SKILL_DIR}/ for IaC templates (.tf, .yaml, .json, .template), application configs, container definitions, and web server configs.
Cloud storage: check for publicly accessible S3 buckets, unencrypted storage accounts, missing versioning, and overly permissive bucket policies (CIS AWS 2.1.1, 2.1.2).
Network security: flag security groups allowing 0.0.0.0/0 ingress on sensitive ports (22, 3389, 3306, 5432, 27017), missing VPC flow logs, and absent network segmentation.
IAM and access: detect wildcard (*) permissions in IAM policies, service accounts with admin privileges, missing MFA enforcement, and hardcoded credentials in source (CWE-798).
Compute resources: identify EC2/VM instances with unnecessary public IPs, unencrypted volumes, missing IMDSv2 enforcement, and outdated base images.
Database security: flag publicly accessible RDS/Cloud SQL instances, missing encryption at rest, disabled automated backups, default ports exposed without IP restrictions.
Application config: detect debug mode enabled in production, default credentials, CORS wildcard (*), missing CSRF protection, disabled authentication endpoints, and API keys in config files.
Container security: check for containers running as root, missing resource limits, privileged: true, writable root filesystems, and images without pinned digests.
Classify each finding: Critical (immediate exploitation risk), High (significant security impact), Medium (configuration weakness), Low (best practice violation).
Generate findings report at ${CLAUDE_SKILL_DIR}/security-findings/misconfig-YYYYMMDD.md with per-finding severity, CIS/CWE mapping, affected file and line, remediation code, and verification command.

See ${CLAUDE_SKILL_DIR}/references/implementation.md for the full six-section implementation guide covering IaC, application, and system checks.

Output

Findings Report: ${CLAUDE_SKILL_DIR}/security-findings/misconfig-YYYYMMDD.md with all misconfigurations categorized by severity
Remediation Plan: minimal-change fixes with before/after config snippets and verification commands
Compliance Mapping: each finding linked to CIS Benchmark, OWASP, or CWE reference
Summary Dashboard: finding counts by severity and category

Error Handling

Error	Cause	Solution
Syntax error in `${CLAUDE_SKILL_DIR}/terraform/main.tf`	Malformed HCL, YAML, or JSON	Validate file syntax first; skip malformed files and note parse errors in report
Cannot determine cloud provider from configuration	Missing provider blocks or ambiguous file structure	Look for provider blocks and file naming conventions; fall back to generic security checks
Cannot read encrypted configuration	SOPS-encrypted or binary config files	Request decrypted version or exported config; document inability to audit
Too many config files (500+)	Large monorepo or multi-service project	Prioritize by file type: IaC first, then app configs, then system configs
Flagged configuration is intentional (dev environment)	False positive in non-production context	Support environment-specific exception rules; allow `.securityignore` overrides

Examples

"Scan Terraform files in ${CLAUDE_SKILL_DIR}/ for overly permissive security groups and IAM wildcard policies."
"Review Kubernetes manifests for insecure defaults: privileged containers, missing resource limits, and root execution."
"Audit the Nginx and application configs for debug mode, information disclosure, and missing security headers."

Resources

CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks/
OWASP IaC Security Cheatsheet:
OWASP A05:2021 Security Misconfiguration: https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
tfsec (Terraform scanner): https://github.com/aquasecurity/tfsec
Checkov (multi-cloud IaC scanner): https://www.checkov.io/
CWE-16 Configuration: https://cwe.mitre.org/data/definitions/16.html
${CLAUDE_SKILL_DIR}/references/errors.md -- full error handling reference
${CLAUDE_SKILL_DIR}/references/examples.md -- additional usage examples
https://intentsolutions.io

Source: jeremylongshore/claude-code-plugins-plus-skills → skills/.curated/finding-security-misconfigurations/SKILL.md

Also appears in: jeremylongshore/claude-code-plugins-plus-skills/plugins/security/security-misconfiguration-finder/skills/finding-security-misconfigurations/SKILL.md

---name: finding-security-misconfigurationsdescription: 'Configure identify security misconfigurations in infrastructure-as-code, application settings, and system configurations. Use when you need to audit Terraform/CloudFormation templates, check application config files, validate system security settings, or ensure compliance with security best practices. Trigger with phrases like "find security misconfigurations", "audit infrastructure security", "check config security", or "scan for misconfigured settings". '--- # Finding Security Misconfigurations ## Overview Scan infrastructure-as-code templates, application configuration files, and system settings to detect security misconfigurations mapped to OWASP A05:2021 (Security Misconfiguration) and CIS Benchmarks. Cover cloud resources (AWS, GCP, Azure), container orchestration (Kubernetes, Docker), web servers (Nginx, Apache), and application frameworks. ## Prerequisites - Infrastructure-as-code files accessible in `${CLAUDE_SKILL_DIR}/` (Terraform `.tf`, CloudFormation `.yaml/.json`, Ansible playbooks, Kubernetes manifests) - Application configuration files available (`application.yml`, `config.json`, `.env.example`, `web.config`) - Container definitions (`Dockerfile`, `docker-compose.yml`, Helm charts) - Web server configs (`nginx.conf`, `httpd.conf`, `.htaccess`) if applicable - Write permissions for findings output in `${CLAUDE_SKILL_DIR}/security-findings/` - Optional: `tfsec`, `checkov`, or `trivy config` installed for automated pre-scanning ## Instructions 1. Discover all configuration files by scanning `${CLAUDE_SKILL_DIR}/` for IaC templates (`.tf`, `.yaml`, `.json`, `.template`), application configs, container definitions, and web server configs. 2. **Cloud storage**: check for publicly accessible S3 buckets, unencrypted storage accounts, missing versioning, and overly permissive bucket policies (CIS AWS 2.1.1, 2.1.2). 3. **Network security**: flag security groups allowing `0.0.0.0/0` ingress on sensitive ports (22, 3389, 3306, 5432, 27017), missing VPC flow logs, and absent network segmentation. 4. **IAM and access**: detect wildcard (`*`) permissions in IAM policies, service accounts with admin privileges, missing MFA enforcement, and hardcoded credentials in source (CWE-798). 5. **Compute resources**: identify EC2/VM instances with unnecessary public IPs, unencrypted volumes, missing IMDSv2 enforcement, and outdated base images. 6. **Database security**: flag publicly accessible RDS/Cloud SQL instances, missing encryption at rest, disabled automated backups, default ports exposed without IP restrictions. 7. **Application config**: detect debug mode enabled in production, default credentials, CORS wildcard (`*`), missing CSRF protection, disabled authentication endpoints, and API keys in config files. 8. **Container security**: check for containers running as root, missing resource limits, `privileged: true`, writable root filesystems, and images without pinned digests. 9. Classify each finding: **Critical** (immediate exploitation risk), **High** (significant security impact), **Medium** (configuration weakness), **Low** (best practice violation). 10. Generate findings report at `${CLAUDE_SKILL_DIR}/security-findings/misconfig-YYYYMMDD.md` with per-finding severity, CIS/CWE mapping, affected file and line, remediation code, and verification command. See `${CLAUDE_SKILL_DIR}/references/implementation.md` for the full six-section implementation guide covering IaC, application, and system checks. ## Output - **Findings Report**: `${CLAUDE_SKILL_DIR}/security-findings/misconfig-YYYYMMDD.md` with all misconfigurations categorized by severity - **Remediation Plan**: minimal-change fixes with before/after config snippets and verification commands - **Compliance Mapping**: each finding linked to CIS Benchmark, OWASP, or CWE reference - **Summary Dashboard**: finding counts by severity and category ## Error Handling | Error | Cause | Solution | |-------|-------|----------| | Syntax error in `${CLAUDE_SKILL_DIR}/terraform/main.tf` | Malformed HCL, YAML, or JSON | Validate file syntax first; skip malformed files and note parse errors in report | | Cannot determine cloud provider from configuration | Missing provider blocks or ambiguous file structure | Look for provider blocks and file naming conventions; fall back to generic security checks | | Cannot read encrypted configuration | SOPS-encrypted or binary config files | Request decrypted version or exported config; document inability to audit | | Too many config files (500+) | Large monorepo or multi-service project | Prioritize by file type: IaC first, then app configs, then system configs | | Flagged configuration is intentional (dev environment) | False positive in non-production context | Support environment-specific exception rules; allow `.securityignore` overrides | ## Examples - "Scan Terraform files in `${CLAUDE_SKILL_DIR}/` for overly permissive security groups and IAM wildcard policies." - "Review Kubernetes manifests for insecure defaults: privileged containers, missing resource limits, and root execution." - "Audit the Nginx and application configs for debug mode, information disclosure, and missing security headers." ## Resources - CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks/ - OWASP IaC Security Cheatsheet: - OWASP A05:2021 Security Misconfiguration: https://owasp.org/Top10/A05_2021-Security_Misconfiguration/ - tfsec (Terraform scanner): https://github.com/aquasecurity/tfsec - Checkov (multi-cloud IaC scanner): https://www.checkov.io/ - CWE-16 Configuration: https://cwe.mitre.org/data/definitions/16.html - `${CLAUDE_SKILL_DIR}/references/errors.md` -- full error handling reference - `${CLAUDE_SKILL_DIR}/references/examples.md` -- additional usage examples - https://intentsolutions.io --- **Source:** [`jeremylongshore/claude-code-plugins-plus-skills`](https://github.com/jeremylongshore/claude-code-plugins-plus-skills) → `skills/.curated/finding-security-misconfigurations/SKILL.md` **Also appears in:** `jeremylongshore/claude-code-plugins-plus-skills/plugins/security/security-misconfiguration-finder/skills/finding-security-misconfigurations/SKILL.md`

thedixitjain/the-mega-skill-library/tree/main/library/security-and-compliance/finding-security-misconfigurations commit 457120e6d4

Frequently asked questions

npx skillmds add thedixitjain/finding-security-misconfigurations