skills.rest
amitkarpe
amitkarpeCOMMUNITY
Explore all skills by this author →
Website𝕏@amitkarpeGitHub

ops-scan-candidate-selection

Selects safe EC2 scan candidates using read-only AWS and SSM evidence.

Updated Apr 14, 2026
Search Tags:#aws#vulnerability assessment#ec2#read-only#ssm#nessus#scan selection
One-click install
npx skills add https://github.com/amitkarpe/agent-skills --skill ops-scan-candidate-selection-amitkarpe
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ops-scan-candidate-selection
Source: https://github.com/amitkarpe/agent-skills/tree/main/skills/ops-scan-candidate-selection
Command: npx skills add https://github.com/amitkarpe/agent-skills --skill ops-scan-candidate-selection-amitkarpe

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Operations and security teams need to know exactly which EC2 instances are safe and ready to send for Nessus Manager, patch, CIS, VA, or validation scans, without risking accidental changes to AWS resources or scanning the wrong hosts. ## Core Features & Use Cases - Read-only evidence gathering: Collects instance state, tags, SSM PingStatus, and Nessus agent readiness without relinking, restarting, installing, patching, or mutating any AWS resource. - Candidate classification: Sorts hosts into scan-ready, not-ready, cleanup-after-scan, retain, and needs-owner-confirmation buckets with clear blockers and cautions. - Ops-ready reporting: Produces a RESULT.md with target tables, blockers, and a draft message for Ops/Kishore handoff, plus routing of cleanup candidates to Terraform/Terragrunt cleanup workflows. - Use Case: When Amit asks which PROD EC2s should go to Kishore for a Nessus Manager scan, the skill verifies SSM Online status and agent linkage per host, then delivers a compact target table distinguishing ready hosts from those needing cleanup or owner confirmation. ## Quick Start Ask which EC2 instances in the PROD account are ready for the Nessus Manager scan and request a target table with read-only evidence.

Frequently Asked Questions about ops-scan-candidate-selection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I choose which EC2 instances to send for a Nessus scan?▼

Gather read-only evidence per instance: state, private IP, SSM PingStatus, and Nessus agent status via nessuscli. Classify hosts as scan-ready only when running, private-only, SSM Online, and agent linked, then present the results in a target table.

How to check if Nessus Manager agent is linked on an EC2 host?▼

Run read-only checks over SSM: rpm -q NessusAgent, systemctl is-active and is-enabled nessusagent, and nessuscli agent status. Never print link keys or secrets, and never relink the agent during verification.

Can DEV hosts be used as PROD scan evidence?▼

No, PROD scan evidence requires PROD scan targets by default. DEV hosts may only substitute when the requester explicitly accepts that substitution, and the deviation should be recorded as a caution.

What happens to temporary scan hosts after the scan completes?▼

Hosts tagged as cleanup-after-scan are passed to a repo-owned Terraform or Terragrunt cleanup workflow with approved stack context, rather than being removed with one-off AWS commands. Shared IAM roles and policies stay retained unless explicit approval exists.

Does this approach modify any AWS resources during candidate selection?▼

No, the workflow is strictly read-only. It prohibits relinking, restarting, installing, patching, rebooting, SSM document changes, and any AWS mutation; unclear identity or environment stops the run and records a blocker.

Related Skills

Explore More Software Engineering Skills→
david-2814david-2814
3

ssm

Automate AWS Systems Manager fleet operations across EC2 instances.

Community
Advanced
pantheon-orgpantheon-org
9

terragrunt-validator

Validate Terragrunt IaC configurations with HCL, syntax, lint, and security checks.

Official
Advanced
Q16GQ16G
83

baseline-check

Automate CIS benchmark security baseline checks on Linux/Unix hosts.

Community
Intermediate
vertivolatamvertivolatam
1

Security & Compliance Automation

Automate security and compliance checks for cloud-native environments using OPA, Trivy, and boto3.

Official
Advanced