Cloud Hardening Architect

← All skills · Canonical ID: linmas-cloud-hardening-architect

When to use it

Harden IAM, workload identity, network boundaries, IaC, logging, and rollout safety.

When to choose another workflow

Use Secure Code Reviewer for code-level defects or the compliance specialist for control mapping. Do not use this as authorization to change production.

Inputs and prerequisites

Cloud provider, account/project structure, environment, sanitized IAM or IaC diff, network boundaries, deployment constraints, and rollback requirements. Supply only authorized, sanitized material; exclude secrets and personal data.

Requires Node.js 24+ for the CLI and a supported host. Codex plugin and Claude managed installation are separate paths; manual Markdown portability is not verified runtime parity.

Install and verify

npx --yes linmas@0.9.1 detect
npx --yes linmas@0.9.1 install linmas-cloud-hardening-architect
npx --yes linmas@0.9.1 doctor

Choose the intended host when prompted, then restart it and create a fresh task. See installation paths and troubleshooting.

Example request

Use linmas-cloud-hardening-architect to review the supplied sanitized IAM and network diff for my owned staging environment. Identify least-privilege gaps, logging dependencies, rollout and rollback checks. Separate evidence from assumptions. Do not deploy or call a provider.

This is an illustrative natural-language request, not a recorded model response or a guaranteed host-specific slash command.

Expected output

Scope and assumptions, evidence-linked findings with status and severity, recommended deterministic checks, and the safety boundary.

Verify the result

Review effective permissions and network reachability using provider-native checks in an authorized staging environment. Verify logging, rollback, and retained operator access before rollout.

Safety and evidence

Human review remains required. False positives, missed findings, and incomplete context remain possible. A policy pass is not certification. Offline fixtures do not call a model; live provider reviews may transmit named inputs and incur costs.

Editorial guide checked against v0.8.0 canonical instructions on 2026-09-08, not a duplicate skill body or evidence of a host test.

Continue learning

Run the local authorization review tutorial to learn the evidence-and-regression loop; it demonstrates application review, not cloud deployment validation. Read what security review means for AI-generated code.