SG Deceptive Reachability Auditor
Composes AWS security-group references into a reachability graph to find the lateral-movement path no single rule reveals.
Getest · Werkt
Wat het doet
Builds a directed graph from describe-security-groups/-instances JSON (SG-to-SG references plus an internet edge for 0.0.0.0/0 rules), then BFS-composes the transitive closure from a named entry to report the shortest path to a crown-jewel tier, the blast radius, and any pivot SG - or reports clean and names the boundary on a segmented fleet instead of fabricating a path. Triggers when asked to review a security-group fleet for lateral movement, blast radius, or 'can the internet reach the database'; ships with a FAILURE_MODES.md that names what the SG graph alone cannot confirm (live hosts, route tables, NACLs, app auth).
Testrapport
Ran the bundled replay suite for real (7/7 fixtures pass, including the four deceptive-clean ones where it correctly refuses to fabricate a path); on a fresh 4-SG fleet I built myself, a naive per-rule read called every rule 'properly scoped' and recommended no action, while the skill composed the exact internet->web->app->db critical path to the crown jewel that the per-rule read missed entirely.
Getest op: 2026-07-15 · Claude Code 2.x (agent harness)
Installatie
git clone https://github.com/anyshift-io/sre-skills mkdir -p ~/.claude/skills cp -r sre-skills/skills/sg-deceptive-reachability-auditor ~/.claude/skills/sg-deceptive-reachability-auditor
Commando's en voorbeeldprompts
/sg-deceptive-reachability-auditorComposes AWS security-group references into a reachability graph to find the lateral-movement path no single rule reveals.
Skills reageren op gewone verzoeken — geen commando's om te onthouden. Na installatie activeren prompts zoals deze de skill (in het Engels):
Audit this fleet of security groups for lateral movement to the databaseCan the internet reach our database through this AWS security group setup?We had a CI host compromised, what could it reach from there?