From orca-skills
Maps internet-facing assets, ranks by exploitability risk, identifies exposed ports/services, public storage, and vulnerabilities from an attacker's perspective. Use for attack surface analysis.
npx claudepluginhub orcasecurity/orca-skills --plugin orca-skillsThis skill uses the workspace's default tool permissions.
Answers the question: **"What can an attacker see from outside, and what's the easiest way in?"**
Retrieves full 360° security profiles for cloud assets including alerts, attack paths, compliance violations, permissions, exposure, sensitive data, and CDR activity. Use for asset posture reviews.
Reviews external attack surface via Zscaler EASM: lists organizations/findings (exposed services, vulnerabilities, misconfigs), lookalike domains, generates prioritized risk summary. For security exposure audits.
Reviews SentinelOne XSPM misconfigurations across AWS, Azure, GCP, Kubernetes, identity, and IaC. Covers detection, compliance standards, MITRE ATT&CK mappings, remediation steps, evidence, and MSP posture workflows.
Share bugs, ideas, or general feedback.
Answers the question: "What can an attacker see from outside, and what's the easiest way in?"
Maps all internet-facing assets, ranks them by exploitability, groups by attack vector (exposed services, public storage, vulnerable web apps, open management ports), and presents the environment from an attacker's perspective.
/orca-exposure-map
/orca-exposure-map account 123456789012
/orca-exposure-map web services
Or natural language:
Parse user input:
Run 6 discovery_search queries to cover different exposure types:
Query 1: Internet-facing assets with critical vulns
discovery_search:
search_phrase: "internet facing assets with critical vulnerabilities"
limit: 10
Query 2: Publicly accessible storage
discovery_search:
search_phrase: "publicly accessible S3 buckets or storage with sensitive data"
limit: 10
Query 3: Exposed management interfaces
discovery_search:
search_phrase: "internet facing assets with exposed management ports SSH RDP"
limit: 10
Query 4: Exposed web applications
discovery_search:
search_phrase: "internet facing web applications with high vulnerabilities"
limit: 10
Query 5: Exposed databases
discovery_search:
search_phrase: "internet facing databases or database ports exposed"
limit: 10
Query 6: Assets with public IPs and critical alerts
discovery_search:
search_phrase: "public facing assets with critical open alerts"
limit: 10
For the top 5 most critical exposed assets, run in parallel:
Per asset:
get_asset_related_alerts_summary:
asset_id: <UUID>
get_asset_related_attack_paths_summary:
asset_id: <UUID>
get_asset_crown_jewel_info:
group_unique_id: <group_unique_id>
Rank each exposed asset by exploitability:
CRITICAL — Immediate exploitation likely:
• Public-facing + known exploit available (EPSS > 0.5)
• Exposed management port (SSH/RDP) + weak auth alert
• Public storage with sensitive data
• Exposed database with default credentials
HIGH — Exploitable with moderate effort:
• Public-facing + critical CVE (no known exploit yet)
• Exposed web app + SQL injection / RCE vulnerability
• Public-facing + multiple high vulnerabilities stacked
MEDIUM — Requires specific conditions:
• Public-facing + high CVE but behind WAF/CDN
• Exposed service with informational vulns
• Public IP but limited attack surface (few ports)
LOW — Minimal exposure:
• Public-facing but no known vulnerabilities
• Exposed but with strong auth/encryption
• CDN/load balancer with no backend vulns
Group by attack vector (how an attacker would approach):
For critical exposed assets, trace attack paths:
This shows the "outside-in" kill chain — not just what's exposed, but what an attacker reaches AFTER getting in.
CRITICAL: Never leave the user with just data. After EVERY output layer, suggest the next action and offer to generate remediation code.
After the dashboard and after every drill-down section:
When the user selects a format:
lockdown-<asset-name>.<ext> (e.g., .tf, .yml, .sh)Format mapping:
| User says | Extension | Template |
|---|---|---|
| Terraform | .tf | HCL with security group / bucket policy / network resources |
| CloudFormation | .cfn.yaml | YAML template with security resources |
| Ansible | .yml | Playbook with security hardening tasks |
| CLI | .sh | Shell script with aws/az/gcloud CLI commands |
| Instructions | inline | Numbered step-by-step console walkthrough |
| Pulumi | .ts | TypeScript Pulumi program |
| ARM/Bicep | .bicep | Bicep template |
═══════════════════════════════════════════════════════════════════
EXPOSURE MAP — External Attack Surface
<date> | <account scope>
═══════════════════════════════════════════════════════════════════
SURFACE: <assessment — 1 line>
┌─────────────────────────────────────────────────────────────────┐
│ EXPOSED ASSETS <N> internet-facing │
│ CRITICAL RISK <N> immediately exploitable │
│ HIGH RISK <N> exploitable with effort │
│ PUBLIC STORAGE <N> buckets/blobs publicly accessible │
│ EXPOSED MGMT <N> SSH/RDP/admin panels │
│ EXPOSED DATABASES <N> databases reachable from internet │
│ CROWN JEWELS <N> exposed critical assets │
│ ATTACK PATHS <N> outside-in kill chains │
└─────────────────────────────────────────────────────────────────┘
TOP TARGETS (attacker's priority list):
[1] <asset> — <why it's #1 target> (score: <X.X>)
<type> | <public IP> | <exposed services>
[2] <asset> — <why> (score: <X.X>)
<type> | <public IP> | <exposed services>
[3] <asset> — <why> (score: <X.X>)
<type> | <public IP> | <exposed services>
[4] <asset> — <why> (score: <X.X>)
[5] <asset> — <why> (score: <X.X>)
RECOMMENDED ACTION:
Priority #1: Lock down <top target> — <reason>.
I can generate the security fix right now.
What format? terraform | cloudformation | ansible | cli |
instructions | pulumi | arm/bicep
═══════════════════════════════════════════════════════════════════
Or drill down: easy wins | web apps | management | data |
attack paths | accounts | all assets | full
═══════════════════════════════════════════════════════════════════
───────────────────────────────────────────────────────────────────
EASY WINS — Fix These First
───────────────────────────────────────────────────────────────────
Assets an attacker can compromise with minimal effort:
[!] <asset> (<type>) in <account>
Public IP: <ip> | Ports: <list>
Vulnerability: <CVE> (exploit available, CVSS <X.X>)
Alerts: <N> critical
Crown jewel: YES/NO
Fix: <1-line action>
[!] <asset> — <description>
...
TOTAL EASY WINS: <N>
Estimated fix time: <hours/days>
LET'S CLOSE THESE:
I'll generate fixes for all easy wins. Choose format:
terraform | cloudformation | ansible | cli | instructions |
pulumi | arm/bicep
───────────────────────────────────────────────────────────────────
───────────────────────────────────────────────────────────────────
WEB ATTACK SURFACE
───────────────────────────────────────────────────────────────────
<asset> (<type>) — <service name>
URL: <public URL/IP:port>
Vulnerabilities:
<CVE> — <title> (CVSS <X.X>, exploit: YES/NO)
<CVE> — <title>
Alerts: <N> (list top 3)
WAF: YES/NO | CDN: YES/NO
<asset> — ...
───────────────────────────────────────────────────────────────────
───────────────────────────────────────────────────────────────────
EXPOSED MANAGEMENT INTERFACES
───────────────────────────────────────────────────────────────────
⚠ <asset> — SSH (22) open to 0.0.0.0/0
IP: <public IP> | Account: <account>
Auth alerts: <weak auth / default creds / brute force detected>
Fix: Restrict to VPN/bastion CIDR
⚠ <asset> — RDP (3389) open to 0.0.0.0/0
...
⚠ <asset> — Admin panel (8080/443) exposed
...
TOTAL EXPOSED: <N> management interfaces
HIGHEST RISK: <asset> — <why>
LOCK THESE DOWN:
I can generate security group restrictions, bastion configs,
or network ACLs. Choose format: terraform | cloudformation |
ansible | cli | instructions | pulumi | arm/bicep
───────────────────────────────────────────────────────────────────
───────────────────────────────────────────────────────────────────
DATA EXPOSURE — Publicly Accessible Data Stores
───────────────────────────────────────────────────────────────────
⚠ <bucket/storage> in <account>
Access: PUBLIC READ / PUBLIC WRITE / PUBLIC LIST
Sensitive data: <types — PII, credentials, API keys, etc.>
Size: <estimated>
Fix: <specific action>
⚠ <database> in <account>
Port: <port> open to internet
Auth: <default creds / weak password / no auth>
Data: <type if known>
Fix: <action>
SECURE THIS DATA:
I can generate bucket policies, encryption configs, or
access controls. Choose format: terraform | cloudformation |
ansible | cli | instructions | pulumi | arm/bicep
───────────────────────────────────────────────────────────────────
───────────────────────────────────────────────────────────────────
OUTSIDE-IN ATTACK PATHS
───────────────────────────────────────────────────────────────────
How an attacker moves from internet to crown jewels:
[1] Score: <X.X>
Entry: <exposed asset> (public IP: <ip>)
→ Exploit: <CVE or misconfiguration>
→ Pivot: <internal asset reached>
→ Target: <crown jewel> (<why it matters>)
Fix entry point: <action to break this chain>
[2] Score: <X.X>
Entry: <exposed asset>
→ ...
TOTAL PATHS: <N>
Crown jewels reachable: <N>
BREAK THESE CHAINS:
Fix the entry point to break all paths at once. I'll generate
the fix. Choose format: terraform | cloudformation | ansible |
cli | instructions | pulumi | arm/bicep
───────────────────────────────────────────────────────────────────
───────────────────────────────────────────────────────────────────
EXPOSURE BY ACCOUNT
───────────────────────────────────────────────────────────────────
Account Exposed Critical Mgmt Ports Public Data
─────────────────────────────────────────────────────────────────────
<account-1> <N> <N> <N> <N>
<account-2> <N> <N> <N> <N>
...
WORST ACCOUNT: <account> — <why>
───────────────────────────────────────────────────────────────────
Full list of all exposed assets with basic details, sorted by risk.
Show all sections in order.
✅ No internet-facing assets with critical vulnerabilities detected.
Your external attack surface appears minimal. Consider:
• Verify this matches your expected architecture
• Check if assets are behind CDN/WAF (may not show as "internet-facing")
• Review network security groups for unintended exposure
⚠ Large attack surface: <N> internet-facing assets detected.
Showing top 10 by risk. For the full inventory:
• Use Orca UI → Inventory → Filter: Internet Facing
• Group by account to assign ownership
• Consider a network segmentation review
<asset> is internet-facing but has no known vulnerabilities.
Risk: LOW (currently)
Note: Attack surface exists — new CVEs could change this.
Recommendation: Monitor for new vulnerabilities, minimize exposure if not needed.
| Tool | Purpose | Parameter |
|---|---|---|
discovery_search | Find exposed assets by category | search_phrase, limit |
get_asset_related_alerts_summary | Alerts on exposed assets | asset_id (UUID) |
get_asset_related_attack_paths_summary | Kill chains from exposed assets | asset_id (UUID) |
get_asset_crown_jewel_info | Crown jewel status of exposed assets | group_unique_id |
| Tool | Purpose | When |
|---|---|---|
get_asset_by_id | Full asset details | Drill-down on specific asset |
get_linked_entities_mapping | What the exposed asset connects to | "attack paths" drill-down |
search_cdr_events | Who's accessing the exposed asset | Investigation |
discovery_search max 10 results per query — use multiple queries with different search phrasesgroup_unique_id from asset data/orca-alert-triage <alert-id> for individual vulnerabilities, /orca-impact-analysis for fix prioritization, /orca-asset-profile for full asset context.