Agent-Skills.md

Agent Skills: Service Mesh Security Analyzer

Analyze Istio, Consul, and Linkerd service mesh configurations for security vulnerabilities with NIST 800-53 control mappings. Use when users need to audit mesh security, identify misconfigurations, check mTLS settings, review ACL policies, or prepare for FedRAMP assessments. Triggers on keywords like "mesh config", "istio security", "consul ACL", "linkerd policy", "service mesh audit", or "NIST compliance".

UncategorizedID: ethanolivertroy/security-agent-skills/mesh-security

Repository

ethanolivertroy/security-agent-skills
hackIDLELicense: MIT
1

Install this agent skill to your local

pnpm dlx add-skill https://github.com/hackIDLE/skills/tree/HEAD/skills/mesh-security

Skill Files

Browse the full folder contents for mesh-security.

Download Skill

Loading file tree…

skills/mesh-security/SKILL.md

Skill Metadata

Name
mesh-security
Description
Analyze Istio, Consul, and Linkerd service mesh configurations for security vulnerabilities with NIST 800-53 control mappings. Use when users need to audit mesh security, identify misconfigurations, check mTLS settings, review ACL policies, or prepare for FedRAMP assessments. Triggers on keywords like "mesh config", "istio security", "consul ACL", "linkerd policy", "service mesh audit", or "NIST compliance".

Service Mesh Security Analyzer

Comprehensive security analysis for Istio, Consul, and Linkerd service mesh configurations with NIST 800-53 Rev 5 control mappings.

Quick Start

Analyze a Configuration File

# Run the analyzer wrapper directly
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js <config-file>

# Examples
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-meshconfig.yaml
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./consul-config.json
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./linkerd-config.yaml --json

Sample Configurations

Test configs are available in the samples/ directory:

  • Istio: samples/sample-meshconfig.yaml
  • Consul: samples/sample-consul-config.json
  • Linkerd: samples/sample-linkerd-config.yaml

Supported Mesh Types

Istio

Auto-detection: Files with kind: MeshConfig and apiVersion containing istio.io

Security Checks: | Category | What It Checks | |----------|----------------| | mTLS | Enabled status, STRICT mode enforcement | | Certificates | CA provider, validity duration (optimal 90 days) | | Peer Authentication | Default peer auth, STRICT mode | | Proxy Config | Privileged mode, image versioning, holdApplicationUntilProxyStarts | | Secret Discovery | SDS enabled for certificate management | | Trust Domain | Explicitly configured, not using default | | Authorization | Default deny policies | | Telemetry | Enabled collection, access logging | | RBAC | Role-based access control enforcement | | Traffic Policy | Outbound traffic restricted to REGISTRY_ONLY |

Consul

Auto-detection: Files with mesh_type: "consul" or containing connect, tls, and acl fields

Security Checks: | Category | What It Checks | |----------|----------------| | Service Mesh | Connect enabled | | Proxy Security | No privileged mode | | TLS Security | verify_incoming, verify_outgoing, hostname verification | | Access Control | ACL enabled, default deny policy, agent tokens | | Telemetry | Service metrics enabled | | Auto-Encryption | TLS auto-encrypt feature | | Gossip Encryption | Key configured, proper length, verification | | FedRAMP Compliance | TLS 1.2+, FIPS ciphers, strong encryption |

Linkerd

Auto-detection: Files with mesh_type: "linkerd" or containing identity, proxy, and policy fields

Security Checks: | Category | What It Checks | |----------|----------------| | TLS Security | Enabled, enforced, cipher suites, min version 1.2 | | Service Identity | Enabled, certificate issuer, validity period | | Proxy Config | Non-privileged, versioning, timeouts, resource limits | | Authorization | Policy enforcement, default deny, specific rules | | Authentication | Strict mode enforcement | | Observability | Tracing enabled, sampling, collector config | | Metrics | Enabled, Prometheus integration, retention | | Traffic Rules | TLS in destination rules, system namespace protection |

Severity Levels

| Level | Meaning | Example Issues | |-------|---------|----------------| | Critical | Immediate security risk | RBAC/ACL disabled, mTLS not enforced, gossip encryption missing | | High | Significant vulnerability | Permissive auth modes, privileged containers, missing hostname verification | | Medium | Security weakness | Default trust domains, long certificate validity, missing telemetry | | Low | Best practice violation | Non-pinned images, missing timeouts, default CA providers |

NIST 800-53 Control Mappings

Findings are mapped to these NIST 800-53 Rev 5 controls:

| Control | Title | Relevant Checks | |---------|-------|-----------------| | AC-3 | Access Enforcement | RBAC, ACL, Authorization policies | | AC-4 | Information Flow Enforcement | Outbound traffic policy, Policy enforcement | | AC-17 | Remote Access | mTLS, TLS configuration | | AU-2 | Audit Events | Telemetry, Access logging | | AU-3 | Content of Audit Records | Logging configuration | | AU-12 | Audit Generation | Metrics, Tracing | | CA-3 | System Interconnections | Trust domain, Peer authentication | | CM-2 | Baseline Configuration | Proxy config, Default settings | | CM-6 | Configuration Settings | Security hardening | | CM-7 | Least Functionality | Privileged mode, Outbound restrictions | | IA-2 | Identification and Authentication | Service identity, Authentication | | IA-5 | Authenticator Management | Certificate management, SDS | | SC-7 | Boundary Protection | Traffic policy, Network segmentation | | SC-8 | Transmission Confidentiality | mTLS, TLS settings | | SC-12 | Cryptographic Key Management | Certificate validity, CA settings | | SC-13 | Cryptographic Protection | Cipher suites, TLS versions | | SC-23 | Session Authenticity | Peer authentication, Trust chain | | SI-4 | System Monitoring | Telemetry, Metrics, Tracing |

Workflow: Analyze a Mesh Configuration

  1. Read the configuration file to understand its structure
  2. Run the analyzer using the wrapper script
  3. Review findings by severity (Critical first)
  4. Check NIST mappings for compliance requirements
  5. Generate remediation recommendations if needed

Example Analysis Session

User: Analyze my Istio mesh configuration at ./istio-config.yaml

Steps:
1. Read the file to understand the mesh configuration
2. Run: node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-config.yaml
3. Present findings grouped by severity
4. Highlight critical/high severity issues first
5. Include NIST control mappings for compliance context
6. Offer to generate fixes or compliance report

Output Format

Markdown (Default)

## Security Analysis Results

**Mesh Type:** Istio
**File:** ./istio-config.yaml
**Total Findings:** 5

| Severity | Count |
|----------|-------|
| Critical | 1     |
| High     | 2     |
| Medium   | 2     |
| Low      | 0     |

### Critical Findings

#### 1. mTLS Configuration
**Issue:** mTLS is not set to STRICT mode
**Location:** `spec.mtls.mode`
**Recommendation:** Set mTLS mode to STRICT to enforce mutual TLS
**NIST Controls:** SC-8, SC-13

JSON (--json flag)

{
  "success": true,
  "meshType": "istio",
  "findings": [...],
  "summary": { "critical": 1, "high": 2, "medium": 2, "low": 0, "total": 5 }
}

Related Skills

  • mesh-remediation - Generate and apply security fixes
  • mesh-compliance-reporter - Generate FedRAMP/NIST compliance reports

Programmatic Usage

const { analyzeConfig, formatFindings } = require('~/.claude/skills/mesh-security/lib/analyzer-wrapper.js');

// Analyze a config file
const results = analyzeConfig('./istio-config.yaml');
console.log(formatFindings(results));

// Or specify mesh type explicitly
const consulResults = analyzeConfig('./config.json', 'consul');