orca-skills

In the author's own words, from each skill's SKILL.md.

• orca-account-health

  Cloud account coverage and sync-health audit — lists every connected cloud account, sync status, scanner deployment, integration health, and flags blind spots before any audit, investigation, or security review. Use when user asks about coverage, account health, sync status, scanner deployment, "are we monitoring X", or "do we have full coverage" (e.g., "account health", "are all accounts connect…

  skills/orca-account-health/SKILL.md on GitHub (opens in a new tab)

• orca-admin-access-grouping

  Admin access grouping - fetches Orca's pre-computed admin clustering (IAM Policy Optimizer) for AWS, Azure, and GCP, groups every admin identity into a small number of shared least-privilege policies that replace blanket AdministratorAccess / Owner, and drives the swap through a staged, confirmation-gated apply. Use when the user wants to group or tier their admins, cut down how many people hold…

  skills/orca-admin-access-grouping/SKILL.md on GitHub (opens in a new tab)

• orca-alert-triage

  Analyzes Orca Security alerts with timeline visualization, risk assessment, and progressive disclosure. Use when user asks to triage, analyze, explain, summarize, investigate, or check an Orca alert by ID (e.g., "triage orca-3636513", "what is alert orca-3548863", "check orca-3636513").

  skills/orca-alert-triage/SKILL.md on GitHub (opens in a new tab)

• orca-asset-profile

  Full 360° security profile of any cloud asset — alerts, attack paths, compliance, permissions, exposure, sensitive data, and CDR activity in one view. Use when user asks about an asset's security posture or profile (e.g., "asset profile for web-bastion-host", "tell me about WEB-PRD", "security posture of", "show me everything about").

  skills/orca-asset-profile/SKILL.md on GitHub (opens in a new tab)

• orca-cloud-cost-optimizer

  Cloud cost optimization analysis using Orca Security asset data. Discovers all cloud assets (AWS, GCP, Azure) through Orca MCP tools, compares current configurations against cheaper alternatives using live public pricing, and produces a prioritized cost reduction report with exact asset evidence. Use when the user asks about cloud cost optimization, reducing cloud spend, rightsizing instances, sa…

  skills/orca-cloud-cost-optimizer/SKILL.md on GitHub (opens in a new tab)

• orca-compliance-gap

  Deep-dive compliance gap analysis for any framework — failing controls ranked by impact, quick wins, account breakdown, and remediation plan. Use when user asks about compliance gaps, failures, or status (e.g., "compliance gaps", "PCI DSS status", "where are we failing", "SOC 2 compliance", "quick wins").

  skills/orca-compliance-gap/SKILL.md on GitHub (opens in a new tab)

• orca-config-origin

  Traces any Orca alert back to who deployed it, what tool was used, what introduced the issue, and a full timeline of events. Use when user asks about origin, deployment, or ownership of an alert (e.g., "who created this", "where did this come from", "trace back orca-3380725", "who deployed", "what tool was used").

  skills/orca-config-origin/SKILL.md on GitHub (opens in a new tab)

• orca-custom-framework

  Creates custom compliance frameworks from existing frameworks, alert lists, or security themes — organizes controls into sections, maps alerts, and pushes the framework to Orca. Suggests creating custom discovery alerts for gaps not covered by existing rules. Use when user asks to create, build, or generate a custom compliance framework.

  skills/orca-custom-framework/SKILL.md on GitHub (opens in a new tab)

• orca-cve-blast-radius

  CVE blast-radius analysis — given a single CVE-ID, find every affected asset across all accounts, rank by real exposure (internet-facing, attack-path participant, crown jewel) instead of static CVSS. Use when user asks about a specific CVE's environmental impact (e.g., "blast radius of CVE-2024-1234", "where are we affected by Log4Shell", "which assets have CVE-2021-44228", "who is exposed to CVE…

  skills/orca-cve-blast-radius/SKILL.md on GitHub (opens in a new tab)

• orca-data-exposure

  DSPM view — sensitive data at risk across the environment, exposed secrets/PII/credentials, data store security posture, and remediation priorities. Use when user asks about data exposure, sensitive data, or secrets (e.g., "data exposure", "where is our PII", "sensitive data at risk", "exposed secrets", "DSPM view").

  skills/orca-data-exposure/SKILL.md on GitHub (opens in a new tab)

• orca-exposure-map

  External attack surface mapping — internet-facing assets ranked by risk, exposed ports/services, and attacker's-eye view of the environment. Use when user asks about attack surface, exposure, or external view (e.g., "exposure map", "attack surface", "what's exposed", "internet-facing", "external view").

  skills/orca-exposure-map/SKILL.md on GitHub (opens in a new tab)

• orca-identity-review

  Analyzes any cloud identity for overprivileged access, actual usage patterns, lateral movement risk, and least-privilege recommendations. Use when user asks about identity permissions, overprivileged access, or IAM review (e.g., "identity review for anika", "is this role overprivileged", "review permissions", "IAM analysis").

  skills/orca-identity-review/SKILL.md on GitHub (opens in a new tab)

• orca-impact-analysis

  Analyzes the full impact of fixing an Orca alert — what closes, what breaks, and what the environment looks like after the fix. Use when user asks about impact, consequences, or blast radius of fixing an alert (e.g., "what's the impact of fixing orca-3380725", "if I fix this what breaks", "what else closes").

  skills/orca-impact-analysis/SKILL.md on GitHub (opens in a new tab)

• orca-inactive-identities-cleanup

  Inactive-identity cleanup - finds inactive identities (users, groups, and non-human identities) across an account, business unit, or tag in every cloud provider Orca supports (AWS, Azure incl. Entra ID, GCP incl. Google Workspace, Alibaba Cloud, OCI, Tencent Cloud), ranks them by identity risk score (highest risk first), and drives remediation through a non-destructive path (disable) or a destruc…

  skills/orca-inactive-identities-cleanup/SKILL.md on GitHub (opens in a new tab)

• orca-investigate

  CDR-powered incident investigation — traces actor activity, builds session timelines, maps MITRE ATT&CK techniques, and assesses blast radius from cloud audit logs. Use when user asks to investigate activity, trace an actor, or analyze an incident (e.g., "investigate bastion-admin", "trace activity", "what did anika do", "incident investigation").

  skills/orca-investigate/SKILL.md on GitHub (opens in a new tab)

• orca-k8s-connector-troubleshoot

  Diagnoses Kubernetes Connector (K8s Tunnel Client / Helm chart `orca-tunnel`) install and connectivity failures from raw customer input — error text, `helm status`, `kubectl describe`, or pod logs — and walks through step-by-step remediation. Use when a user reports the K8s Connector won't install, won't connect, keeps disconnecting, or the cluster shows connected but no scan data appears.

  skills/orca-k8s-connector-troubleshoot/SKILL.md on GitHub (opens in a new tab)

• orca-mfa-enforcement

  Finds users who can sign in without MFA across an account, business unit, or tag, ranks them by identity risk, and drives guided enrollment or gated enforcement. Use for MFA or 2FA gaps, root-account MFA, and MFA coverage evidence for an audit.

  skills/orca-mfa-enforcement/SKILL.md on GitHub (opens in a new tab)

• orca-morning-briefing

  Daily security briefing summarizing new critical alerts, attack paths, compliance drift, exposure changes, and aging unactioned alerts from the last 24-72 hours. Use when user asks for a briefing, summary, or overview (e.g., "morning briefing", "what happened", "security summary", "daily report", "what needs attention").

  skills/orca-morning-briefing/SKILL.md on GitHub (opens in a new tab)

• orca-overprivileged-identities-rightsizing

  Over-privileged identity right-sizing - finds identities holding more permissions than they use, per Orca's pre-computed PoLP (Principle of Least Privilege) recommendations, across an account, business unit, or tag in AWS, Azure, and GCP. Use when the user wants to right-size over-privileged identities, reduce excess permissions across an account, or apply Orca's PoLP / least-privilege recommenda…

  skills/orca-overprivileged-identities-rightsizing/SKILL.md on GitHub (opens in a new tab)

• orca-supply-chain-exposure

  Supply chain exposure check — given a list of suspect packages (e.g. an MDR advisory like the @antv/* npm campaign), find which versions are deployed across the environment, which match the vulnerable range, and which assets carry them. Use when user asks about supply chain risk, package exposure, IOC package check, malicious package, or "are we running X" (e.g., "are we exposed to the @antv atta…

  skills/orca-supply-chain-exposure/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• ui-ux-pro-max-skillby nextlevelbuilder An AI skill that provides design intelligence for building professional UI/UX across multiple platforms. 136k stars · 7 skills
• CowAgentby zhayujie Open-source personal AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-agent,… 47.4k stars · 3 skills
• khazix-skillsby KKKKhazix 数字生命卡兹克开源的 AI Skills 合集 | Agent Skills: leader（帮你定义目标）, neat-freak 洁癖, hv-analysis, khazix-writer & more — Claude Code, Codex & 40+ agents 21.4k stars · 6 skills
• AI-Research-SKILLsby Orchestra-Research Comprehensive open-source library of AI research and engineering skills for any AI model. Package the skills and your claude code/codex/gem… 13.6k stars · 30 skills
• Wazaby tw93 🥷 Engineering habits you already know, turned into skills AI assistants like Claude Code, Codex and Cursor can run. 7.3k stars · 8 skills
• J-Space-Cognition-Suiteby Tiger3807861189 J-Space Cognition Suite — a model-agnostic inference-time control suite for deep reasoning, long-horizon work, verification, and recovery.… 3k stars · 1 skill