hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
130+ ready-to-use security prompts for cloud engineers, platform teams, developers, and AI builders.
Paste a prompt into Claude, ChatGPT, Copilot, Gemini, or any AI assistant, add your requirements, and get infrastructure, code, policies, and runbooks that follow current security practice for AWS, Azure, Google Cloud, Kubernetes, CI/CD, SaaS, and AI systems.
It also ships as a Claude Code plugin with an IaC security review skill, slash commands, and agents.
## Prompt/plugin install secure-cloud-prompt-engineering --marketplace uttej-badwane/secure-cloud-prompt-engineeringOn Claude Code versions before 2.1.275, add the marketplace first:
/plugin marketplace add uttej-badwane/secure-cloud-prompt-engineering
/plugin install secure-cloud-prompt-engineering@uttej-badwaneOr install only the skill by hand:
git clone https://github.com/uttej-badwane/secure-cloud-prompt-engineering.git
cp -r secure-cloud-prompt-engineering/skills/iac-security-review ~/.claude/skills/Then try:
"Review my Terraform files for security issues""Audit the Kubernetes manifests against CIS benchmarks""Scan my GitHub Actions workflows for security misconfigurations""Run a compliance check against NIST 800-53 and PCI-DSS"See skills/iac-security-review/README.md for details.
Each folder has its own README with the full list of prompts and what each one covers.
| Folder | Prompts | What it covers |
|---|---|---|
| ☁️ aws/ | 19 | IAM, S3, VPC, EC2, KMS, RDS, DynamoDB, ECS/ECR, Lambda, CloudFront/WAF, Cognito, Route 53, messaging, data perimeter, Control Tower, security services, CDK, CloudFormation, CLI |
| 🔷 azure/ | 10 | Entra ID, landing zone and policy, Storage, Key Vault, networking, App Service/Functions, SQL/Cosmos DB, Defender/Sentinel, Bicep, VMs |
| 🟢 gcp/ | 10 | Organization and IAM, VPC, Cloud Storage, Cloud Run, Cloud SQL, BigQuery, KMS/Secret Manager, logging/SCC, VPC Service Controls, Compute Engine |
| ☸️ kubernetes/ | 13 | Pod security, managed clusters (EKS/AKS/GKE), RBAC, admission policy, network policy and mesh, Gateway API, runtime, GitOps, multi-tenancy, secrets, cluster hardening, Helm, Kustomize |
| 🐳 docker/ | 4 | Dockerfile, Compose, host and daemon hardening, container registries |
| 🏗️ terraform/ | 8 | AWS, Azure, GCP, multi-cloud, state security, module and provider supply chain, HCP Terraform, OpenTofu |
| 🧱 iac/ | 2 | Pulumi, Crossplane |
| 🔄 cicd/ | 8 | GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CodeBuild/CodePipeline, Cloud Build, CircleCI, self-hosted runners |
| ⚙️ ansible/ | 4 | Playbooks, Vault, Automation Platform/AWX, CIS and STIG hardening |
| 🪪 identity/ | 5 | Workload identity federation, workforce SSO and MFA, privileged access, non-human identities, OAuth/OIDC |
| 🌐 network/ | 6 | API security, WAF and DDoS, zero trust access, hybrid connectivity, egress control, TLS certificates |
| 📊 monitoring/ | 4 | Logging, audit logging baseline, detection engineering, observability stack |
| 🛡️ security/ | 19 | Threat modeling, architecture review, IR, forensics, tabletops, supply chain, secrets, keys, data/DLP, ransomware, policy as code, assessments, pentesting, compliance, FedRAMP/CMMC, sovereignty, post-quantum crypto |
| 🤖 ai/ | 8 | AI agents and MCP, LLM platforms, RAG, coding assistants, model supply chain, MLOps, AI red teaming, AI gateways |
| 🧩 saas/ | 5 | GitHub organizations, Microsoft 365, Google Workspace, Okta, SaaS posture |
| 🐍 python/ | 5 | Secure coding, cloud SDKs, FastAPI/Django/Flask, packaging, clean code style |
| ✨ code-quality/ | 4 | Clean code, secure code review, IaC style, testing strategy |
Plus docs/security-checklist.md, a pre-deployment checklist.
| You are a... | Start with |
|---|---|
| Cloud security engineer | security-services, cloud-security-assessment, data-perimeter, detection-engineering |
| Platform or DevOps engineer | terraform-state, managed-kubernetes, github-actions, workload-identity-federation |
| Application developer | python-secure-coding, api-security, oauth-oidc, secure-code-review |
| AI engineer | ai-agent-mcp, rag-security, model-supply-chain, ai-red-teaming |
| Incident responder | cloud-incident-response, cloud-forensics, incident-response-tabletop |
| GRC or public sector | compliance-frameworks, fedramp-cmmc-readiness, data-residency, ansible-cis-stig |
| Component | What it does |
|---|---|
skills/iac-security-review | Reviews Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm, and CI/CD files, with findings mapped to CIS, NIST 800-53, NIST 800-171, PCI DSS, SOC 2, HIPAA, GDPR, and ISO 27001 |
commands/ | /iac-security-review, /compliance-check, /secret-scan, /fix-finding, /generate-report |
agents/ | security-reviewer, compliance-mapper, report-generator |
rules/ | Security-first and IaC coding standards |
hooks/ | Session context and a warning before destructive commands |
Always review AI-generated output, run your own scanners, and test before production. Prompts are guidance, not a guarantee of compliance.
New prompts and fixes are welcome. See CONTRIBUTING.md and start from the prompt template. Run python3 scripts/build_index.py after adding a prompt to update the folder index.
MIT. See LICENSE.
⭐ If this helps you, please star the repo and share it with your team.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.