Is the SG Deceptive Reachability Auditor skill free?

Yes. The skill itself is free from anyshift-io/sre-skills. SkillProof publishes the install command and an independent test verdict at no cost.

What is the SG Deceptive Reachability Auditor SkillProof Score?

9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.

How do I install SG Deceptive Reachability Auditor?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use SG Deceptive Reachability Auditor with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

SG Deceptive Reachability Auditor

Composes AWS security-group references into a reachability graph to find the lateral-movement path no single rule reveals.

by anyshift-io · anyshift-io/sre-skills

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.6/10
Tested: Jul 15, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 9865d0b

Ran the bundled replay suite for real (7/7 fixtures pass, including the four deceptive-clean ones where it correctly refuses to fabricate a path); on a fresh 4-SG fleet I built myself, a naive per-rule read called every rule 'properly scoped' and recommended no action, while the skill composed the exact internet->web->app->db critical path to the crown jewel that the per-rule read missed entirely.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 9/10
Docs & honesty 5/5

What SG Deceptive Reachability Auditor does

Builds a directed graph from describe-security-groups/-instances JSON (SG-to-SG references plus an internet edge for 0.0.0.0/0 rules), then BFS-composes the transitive closure from a named entry to report the shortest path to a crown-jewel tier, the blast radius, and any pivot SG - or reports clean and names the boundary on a segmented fleet instead of fabricating a path. Triggers when asked to review a security-group fleet for lateral movement, blast radius, or 'can the internet reach the database'; ships with a FAILURE_MODES.md that names what the SG graph alone cannot confirm (live hosts, route tables, NACLs, app auth).

How to install SG Deceptive Reachability Auditor

git clone https://github.com/anyshift-io/sre-skills
mkdir -p ~/.claude/skills
cp -r sre-skills/skills/sg-deceptive-reachability-auditor ~/.claude/skills/sg-deceptive-reachability-auditor

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger SG Deceptive Reachability Auditor

/sg-deceptive-reachability-auditor Composes AWS security-group references into a reachability graph to find the lateral-movement path no single rule reveals.

It also activates on plain-language prompts like these:

Audit this fleet of security groups for lateral movement to the database
Can the internet reach our database through this AWS security group setup?
We had a CI host compromised, what could it reach from there?

Frequently asked questions

Is the SG Deceptive Reachability Auditor skill free?: Yes. The skill itself is free from anyshift-io/sre-skills. SkillProof publishes the install command and an independent test verdict at no cost.
Does SG Deceptive Reachability Auditor work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 15, 2026. Verdict: Tested · Works. Ran the bundled replay suite for real (7/7 fixtures pass, including the four deceptive-clean ones where it correctly refuses to fabricate a path); on a fresh 4-SG fleet I built myself, a naive per-rule read called every rule 'properly scoped' and recommended no action, while the skill composed the exact internet->web->app->db critical path to the crown jewel that the per-rule read missed entirely.
What is the SG Deceptive Reachability Auditor SkillProof Score?: 9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.
How do I install SG Deceptive Reachability Auditor?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use SG Deceptive Reachability Auditor with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.