serverless

Audit serverless applications for security vulnerabilities across IAM policies and functions.

12|1|Updated Feb 9, 2026

Search Tags:#security #vulnerability #serverless #iam #appsec #cloud functions #lambda

Ready to run

npx skills add https://github.com/florianbuetow/claude-code --skill serverless-florianbuetow

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: serverless
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/serverless
Command: npx skills add https://github.com/florianbuetow/claude-code --skill serverless-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and helps you fix critical security vulnerabilities in your serverless applications, protecting against common attack vectors and misconfigurations.

Core Features & Use Cases

IAM Policy Audit: Detects overprivileged IAM roles and policies.
Event Injection Prevention: Finds vulnerabilities where untrusted event data can be used in commands or queries.
Secrets Management: Identifies secrets stored insecurely in environment variables.
Resource Configuration Checks: Analyzes timeouts, concurrency limits, and temporary directory usage.
Use Case: Audit your AWS Lambda functions for security flaws before deployment to prevent breaches and ensure compliance.

Quick Start

Analyze the serverless security of the files in the current directory.

Frequently Asked Questions about serverless

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit AWS Lambda functions for security vulnerabilities?▼

It scans for overprivileged IAM policies, event injection risks, and plain-text secrets in environment variables. The audit also checks for excessive timeout configurations, missing concurrency limits, and insecure /tmp directory data reuse in Lambda functions.

What serverless security checks should I run before deployment?▼

Before deployment, run security checks for overprivileged IAM roles, event data injection, and insecurely stored secrets. You should also verify resource configurations, including timeout settings, concurrency limits, and temporary directory usage to prevent breaches and ensure compliance.

Does this serverless security audit work with Azure Functions and Google Cloud Functions?▼

Yes, the serverless security audit supports analysis of AWS Lambda, Google Cloud Functions, and Azure Functions. It evaluates associated IAM policies and resource configurations across these platforms to identify common serverless application security flaws.

Can I use semgrep, checkov, and tfsec to scan serverless applications?▼

Yes, you can use semgrep, checkov, and tfsec to scan serverless applications. This Skill integrates with these scanners to identify security vulnerabilities, including event injection and misconfigured IAM policies in your cloud functions.

How do I detect overprivileged IAM policies in cloud functions?▼

To detect overprivileged IAM policies in cloud functions, analyze the roles and permissions attached to your serverless applications. This Skill audits IAM policies to identify excessive permissions that could lead to security breaches if exploited.

Why does my serverless application have event data injection vulnerabilities?▼

Serverless applications have event data injection vulnerabilities when untrusted event data is used directly in commands or queries. This Skill identifies these security flaws by analyzing how event inputs are handled within your Lambda and cloud functions.