orca-exposure-map

# Orca Exposure Map Skill Answers the question: **"What can an attacker see from outside, and what's the easiest way in?"** Maps all internet-facing assets, ranks them by exploitability, groups by attack vector (exposed services, public storage, vulnerable web apps, open management ports), and presents the environment from an attacker's perspective. ## Usage ``` /orca-exposure-map /orca-exposure-map account 123456789012 /orca-exposure-map web services ``` Or natural language: - "what's exposed to the internet?" - "show me our attack surface" - "what can an attacker see?" - "public-facing assets with vulnerabilities" - "exposed ports and services" ## Processing Logic ### Step 1: Determine Scope Parse user input: - **All accounts**: no argument → full environment - **Specific account**: "account 123456789012" → filter - **Specific vector**: "web services" → focus on that category ### Step 2: Gather Data (run ALL in parallel) Run 6 discovery_search queries to cover different exposure types: **Query 1: Internet-facing assets with critical vulns** ``` discovery_search: search_phrase: "internet facing assets with critical vulnerabilities" limit: 10 ``` **Query 2: Publicly accessible storage** ``` discovery_search: search_phrase: "publicly accessible S3 buckets or storage with sensitive data" limit: 10 ``` **Query 3: Exposed management interfaces** ``` discovery_search: search_phrase: "internet facing assets with exposed management ports SSH RDP" limit: 10 `...