implementing-cloud-workload-protection

使用 boto3 和 google-cloud API 实施云工作负载保护，对 EC2/GCE 实例进行运行时安全监控、进程异常检测和文件完整性检查。扫描加密货币挖矿程序、反向 Shell 和未授权二进制文件。适用于为云计算工作负载构建运行时安全控制的场景。

9 stars

bykillvxk

View on GitHub Installation ↓

Best use case

implementing-cloud-workload-protection is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

Teams using implementing-cloud-workload-protection should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

You only need a quick one-off answer and do not need a reusable workflow.
You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/implementing-cloud-workload-protection/SKILL.md --create-dirs "https://raw.githubusercontent.com/killvxk/cybersecurity-skills-zh/main/skills/implementing-cloud-workload-protection/SKILL.md"

Manual Installation

Download SKILL.md from GitHub
Place it in .claude/skills/implementing-cloud-workload-protection/SKILL.md inside your project
Restart your AI agent — it will auto-discover the skill

How implementing-cloud-workload-protection Compares

Feature / Agent	implementing-cloud-workload-protection	Standard Approach
Platform Support	Not specified	Limited / Varies
Context Awareness	High	Baseline
Installation Complexity	Unknown	N/A

Frequently Asked Questions

What does this skill do?

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

SKILL.md Source

# 实施云工作负载保护

## 使用说明

通过检查进程列表、网络连接、文件完整性和资源利用率异常，监控云工作负载的运行时威胁。

```python
import boto3

ssm = boto3.client("ssm")
# 在 EC2 实例上运行命令以检查可疑进程
response = ssm.send_command(
    InstanceIds=["i-1234567890abcdef0"],
    DocumentName="AWS-RunShellScript",
    Parameters={"commands": ["ps aux | grep -E 'xmrig|minerd|cryptonight'"]},
)
```

关键保护领域：
1. 监控加密货币挖矿程序和反向 Shell 进程
2. 对关键系统文件进行文件完整性监控
3. 审计 C2 回调的网络连接
4. 检测资源利用率异常（CPU 飙升）
5. 通过哈希对比检测未授权二进制文件

## 示例

```python
# 检查未经授权的出站连接
ssm.send_command(
    InstanceIds=instances,
    DocumentName="AWS-RunShellScript",
    Parameters={"commands": ["ss -tlnp | grep ESTABLISHED"]},
)
```

Related Skills

securing-kubernetes-on-cloud

from killvxk/cybersecurity-skills-zh

本技能涵盖通过实施 Pod 安全标准（Pod Security Standards）、网络策略、工作负载身份、RBAC 权限控制、镜像准入控制和运行时安全监控，对 EKS、AKS 和 GKE 上的托管 Kubernetes 集群进行加固。涉及云平台特定安全功能，包括 EKS 的 IRSA、GKE 的工作负载身份（Workload Identity）以及 AKS 的托管身份（Managed Identity）。

performing-cloud-storage-forensic-acquisition

from killvxk/cybersecurity-skills-zh

通过收集 API 远程数据和端点设备本地同步客户端制品，对 Google Drive、OneDrive、Dropbox 和 Box 等云存储服务执行取证获取和分析。

performing-cloud-penetration-testing

from killvxk/cybersecurity-skills-zh

对 AWS、Azure 和 GCP 云环境执行授权渗透测试，识别 IAM 错误配置、暴露的存储桶、过度宽松的安全组、无服务器函数漏洞以及从初始访问到账户沦陷的云特定攻击路径。测试人员使用云原生工具及 Pacu、 ScoutSuite 等专用框架枚举并利用云基础设施。适用于云渗透测试、AWS 安全评估、Azure 渗透测试或云基础设施安全测试等请求场景。