--- name: config-scan-2773afb86e2c description: Detect security misconfigurations in config files, Docker, and IaC. Use when reviewing configuration security for containers, Kubernetes, Terraform, or application settings. license: MIT metadata: author: jwynia version: "1.0" type: utility mode: evaluative domain: development --- # Config Scan Security review of configuration files and infrastructure as code. ## Quick Start ``` /config-scan # Scan all config files /config-scan --docker # Docker files only /config-scan --k8s # Kubernetes manifests /config-scan --terraform # Terraform files /config-scan --env # Environment files ``` ## What This Skill Detects ### Environment Files - Secrets in `.env` files - Insecure default values - Missing required security variables ### Docker Security - Running as root - Exposed sensitive ports - Insecure base images - Missing security options ### Kubernetes Security - Privileged containers - Missing resource limits - Insecure service accounts - Network policy gaps ### Infrastructure as Code - Overly permissive IAM policies - Public S3 buckets - Unencrypted storage - Missing security groups ### Application Config - Debug mode enabled - Verbose error messages - Insecure defaults ## Scan Categories ### Environment Files **Files scanned**: `.env`, `.env.*`, `*.env` | Issue | Severity | Description | |-------|----------|-------------| | Secrets in .env | HIGH | Credentials should use secrets manager | | .env committed | CRITICAL | Should be in .gitignore | | DEBUG=true | HIGH | Debug mode in production config | | Weak secrets | MEDIUM | Short or simple values | **Detection patterns**: ``` # Committed .env files git ls-files | grep -E '\.env$|\.env\.' # Secrets in env files (PASSWORD|SECRET|KEY|TOKEN|CREDENTIAL)=.+ # Debug flags DEBUG=(true|1|yes) NODE_ENV=development ``` ### Docker Security **Files scanned**: `Dockerfile`, `docker-compose.yml` | Issue | Severity | Description | |-------|----------|-------------| | USER root | HIGH | Container runs as root | | COPY secrets | CRITICAL | Secrets copied into image | | Latest tag | MEDIUM | Unpinned base image | | Exposed ports | LOW | Wide port exposure | | No healthcheck | LOW | Missing health monitoring | **Detection patterns**: ```dockerfile # Running as root (no USER directive) FROM.*\n(?!.*USER) # Copying secrets COPY.*\.(pem|key|crt|env) COPY.*secret COPY.*password # Unpinned images FROM\s+\w+:latest FROM\s+\w+\s*$ # Dangerous capabilities --privileged --cap-add ``` **docker-compose.yml issues**: ```yaml # Privileged mode privileged: true # All capabilities cap_add: - ALL # Host network network_mode: host # Sensitive mounts volumes: - /:/host - /var/run/docker.sock ``` ### Kubernetes Security **Files scanned**: `*.yaml`, `*.yml` (k8s manifests) | Issue | Severity | Description | |-------|----------|-------------| | privileged: true | CRITICAL | Full host access | | runAsRoot | HIGH | Container runs as root | | No resource limits | MEDIUM | DoS risk | | hostNetwork | HIGH | Pod uses host network | | No securityContext | MEDIUM | Missing security settings | **Detection patterns**: ```yaml # Privileged containers securityContext: privileged: true # Running as root securityContext: runAsUser: 0 runAsNonRoot: false # Host access hostNetwork: true hostPID: true hostIPC: true # Dangerous volume mounts volumes: - hostPath: path: / # Missing limits # (absence of resources.limits) # Wildcard RBAC rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"] ``` ### Terraform/IaC **Files scanned**: `*.tf`, `*.tfvars` | Issue | Severity | Description | |-------|----------|-------------| | Public S3 bucket | CRITICAL | Data exposure | | * in IAM policy | HIGH | Overly permissive | | No encryption | HIGH | Data at rest unencrypted | | 0.0.0.0/0 ingress | HIGH | Open to internet | | Hardcoded secrets | CRITICAL | Credentials in TF | **Detection patterns**: ```hcl # Public S3 acl = "public-read" acl = "public-read-write" # Overly permissive IAM "Action": "*" "Resource": "*" "Principal": "*" # Open security groups cidr_blocks = ["0.0.0.0/0"] ingress { from_port = 0 to_port = 65535 # Missing encryption encrypted = false # (or absence of encryption settings) # Hardcoded secrets password = "..." secret_key = "..." ``` ### Application Config **Files scanned**: `config/*.json`, `*.config.js`, `application.yml` | Issue | Severity | Description | |-------|----------|-------------| | DEBUG=true | HIGH | Debug in production | | Verbose errors | MEDIUM | Stack traces exposed | | CORS * | HIGH | All origins allowed | | No HTTPS | MEDIUM | Unencrypted transport | **Detection patterns**: ```javascript // Debug mode debug: true, DEBUG: true, NODE_ENV: 'development' // Verbose errors showStackTrace: true detailedErrors: true // CORS origin: '*' origin: true Access-Control-Allow-Origin: * // Session security secure: false // cookies httpOnly: false sameSite: 'none' ``` ## Output Format ``` CONFIG SCAN RESULTS =================== Files scanned: 23 Issues found: 15 CRITICAL (2) ------------ [!] Dockerfile:1 - Running as root No USER directive found Fix: Add "USER node" or similar non-root user [!] terraform/s3.tf:12 - Public S3 bucket acl = "public-read" Fix: Remove public ACL, use bucket policies HIGH (5) -------- [H] docker-compose.yml:15 - Privileged container privileged: true Fix: Remove privileged flag, use specific capabilities [H] k8s/deployment.yaml:34 - Missing resource limits No CPU/memory limits defined Fix: Add resources.limits section ... MEDIUM (8) ---------- ... ``` ## Configuration ### Ignore Rules Create `.config-scan-ignore`: ```yaml # Ignore specific files files: - "docker-compose.dev.yml" - "terraform/modules/test/**" # Ignore specific rules rules: - id: "docker-root-user" files: ["Dockerfile.dev"] reason: "Development only" - id: "k8s-no-limits" reason: "Handled by LimitRange" ``` ### Scan Profiles ```yaml # .config-scan.yaml profile: production # or: development, strict # Custom thresholds thresholds: fail_on: high warn_on: medium # Specific scanners scanners: docker: true kubernetes: true terraform: true env_files: true app_config: true ``` ## Best Practices Checked ### Docker - [ ] Non-root user specified - [ ] Base image pinned to digest - [ ] No secrets in build - [ ] Multi-stage build used - [ ] Health check defined - [ ] Read-only root filesystem ### Kubernetes - [ ] Non-root security context - [ ] Resource limits defined - [ ] Network policies in place - [ ] No privileged containers - [ ] Service accounts scoped - [ ] Secrets encrypted at rest ### Terraform - [ ] State file encrypted - [ ] No hardcoded secrets - [ ] Least privilege IAM - [ ] Encryption enabled - [ ] Logging enabled - [ ] No public access by default ## Remediation Examples ### Docker: Run as Non-Root ```dockerfile # Before FROM node:18 # After FROM node:18 RUN groupadd -r app && useradd -r -g app app USER app ``` ### Kubernetes: Security Context ```yaml # Before containers: - name: app image: myapp # After containers: - name: app image: myapp securityContext: runAsNonRoot: true runAsUser: 1000 readOnlyRootFilesystem: true allowPrivilegeEscalation: false ``` ### Terraform: Private S3 ```hcl # Before resource "aws_s3_bucket" "data" { acl = "public-read" } # After resource "aws_s3_bucket" "data" { # No ACL (private by default) } resource "aws_s3_bucket_public_access_block" "data" { bucket = aws_s3_bucket.data.id block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } ``` ## CI/CD Integration ```yaml # GitHub Actions - name: Config Security Scan run: | /config-scan --fail-on high - name: Docker Scan run: | /config-scan --docker --fail-on critical ``` ## Related Skills - `/security-scan` - Full security analysis - `/secrets-scan` - Credential detection - `/dependency-scan` - Package vulnerabilities --- Source attribution: jwynia Original project: https://github.com/diegosouzapw/awesome-omni-skill/blob/a6b3c3005cedf056a48b084671c6282426d6e9fc/skills/devops/config-scan/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: jwynia Original project: https://github.com/diegosouzapw/awesome-omni-skill/blob/a6b3c3005cedf056a48b084671c6282426d6e9fc/skills/devops/config-scan/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Product Management Roles: DevOps / SRE, Security Engineer, Backend Developer, Data Engineer, Product Manager Specialties: DevOps, Backend Tools: Docker, Kubernetes, Terraform Country applicability: Country not specified Classification basis: Source category, role and specialization labels Instruction SHA-256: 324fdbd51a680a743a06ff11f26b8f94b47bdf2fe11f9b42932fa4ba1fbb686f