Find the 0.0.0.0/0 rule that was "temporary" 3 years ago
Audits AWS security groups and K8s network policies for overly permissive rules, unused rules, and conflicts. Cross-references VPC Flow Logs to identify rules that are never hit and can be safely removed.
Create a skill called "Firewall Janitor". Audit security groups and network policies: For AWS security groups: 1. List all security groups and their rules across specified VPCs 2. Flag overly permissive rules: 0.0.0.0/0 inbound, wide port ranges (0-65535), any protocol 3. If VPC Flow Logs are available, identify rules with zero hits in the last 30 days 4. Find duplicate or overlapping rules and detached security groups 5. Detect security groups not attached to any resource For Kubernetes NetworkPolicies: 1. Identify namespaces with no NetworkPolicies (all traffic allowed by default) 2. Check for policies that don't match any pods (selector mismatch) 3. Verify that expected connectivity matches actual policy Generate a cleanup plan with: - Risk level for each change (removing a rule that has zero flow log hits = low risk) - Exact AWS CLI or kubectl commands to apply changes - Terraform resources if managing as code
Security groups accumulate cruft like barnacles. Temporary rules become
permanent, nobody removes rules for decommissioned services, and over
time you end up with a tangle nobody dares touch. This skill makes
cleanup safe.
Debug "Access Denied" without guessing which of 47 policies is wrong
Traces the full IAM policy evaluation chain when you hit an Access Denied — identity policies, resource policies, SCPs, permission boundaries — and tells you exactly which policy is blocking and how to fix it.
Write K8s network policies from "A talks to B on port 443" instead of YAML puzzles
Generates Kubernetes NetworkPolicies from plain-English connectivity requirements. Also audits existing policies, detects missing coverage, and validates that policies match intended behavior.
A calm checklist when fraud hits
Immediate steps, reporting sequences, and long-term hardening for scams and identity theft. Organized by urgency so you know what to do first.
Verify brand offers before you click anything
Screens incoming partnership offers for phishing and scam patterns: suspicious domains, attachments, fake checks, requests to "connect your account," and vague contracts. Outputs a risk rating and safe verification steps.