UUSAP

Evidence · not marketing

Real output, real numbers

Nothing here is a mockup. These are actual verdicts from running the tools, graded on incidents USAP didn't write, with a public registry score to match.

Real output · not a mockup

This is what an agent actually returned.

No marketing copy on this page pretends to be product. The card below is verbatim output from a USAP skill — run it yourself and you get the same shape. Here's how to read it.

python3 cloud-infra/cloud-security-posture/scripts/cloud-security-posture_tool.py --output json
cs-cloud-investigator· cloud-security-posture
highconf 0.86

action

Escalate the public-S3 → IMDSv1 → IAM-wildcard exposure chain: hand off to cloud-workload-protection for runtime containment and identity-access-risk for the over-permissive role.

key_findings

  • public-s3-bucket — arn:aws:s3:::acme-prod-customer-exports has a public-read ACL (CIS AWS 2.1.5); holds customer PII exports
  • imdsv1-enabled — instance i-0a1b… permits IMDSv1, HttpTokens=optional (CIS 5.6); SSRF → instance-credential theft
  • iam-wildcard — role/app-runtime allows Action:* on Resource:* (CIS 1.16); lateral movement once creds are stolen
  • cloudtrail-disabled — CloudTrail off in us-west-2 (CIS 3.1); masks the exfiltration path

evidence_references[0]

source mcp:cloud:list_findings:call_csp7f21
ref   arn:aws:iam::123456789012:role/app-runtime
quote Statement[0]: Effect=Allow, Action=*, Resource=*
T1530T1552.005T1078.004T1562.008
human_approval_required: false
next → cloud-workload-protection · identity-access-risk
1

It reasoned, it didn't list

Four findings, but the verdict names the exploitable chain between them — public bucket, stealable instance creds, a wildcard role to move with, logging off to hide it. An attack path, not a scanner dump.

2

The evidence resolves

The cited source is a live MCP tool-call id with the exact policy statement it read (Action:* on Resource:*). Not "the scan showed it" — a pointer you can re-fetch.

3

Mapped to ATT&CK

T1530, T1552.005, T1078.004, T1562.008 — the chain, in the framework your detections already speak.

4

It escalated — it didn't touch anything

human_approval_required is respected; the agent hands off to containment and IAM review. The world only changes when a person says so.

More real output

Same discipline, other corners of the SOC

container-image-scanLive tool run
critical

Blocks the deploy — and flags an implanted layer

  • CVE-2024-3094 · liblzma5 5.6.0 — XZ Utils backdoor in the base image
  • CVE-2021-44228 · log4j-core 2.14.1 — Log4Shell in an app dependency
  • layer sha256:9c2a1fe3… — no matching Dockerfile step (possible implant, T1525)
T1525T1190conf 0.92
vuln-scanPR gate
high

Catches the credential before it merges

  • hardcoded-credential at src/config.py:14 — quote: PASSWORD = "changeme-prod"
  • sql-string-concat at src/db/profile.js:42 — mapped to threat TM-002
  • public-iac at infra/storage.tf:21 — acl = "public-read"
T1552.001T1190conf 0.84

Graded, not asserted

Scored on incidents USAP didn't write

A held-out corpus of 12hand-labeled cases — real public incidents plus benign traps that keep the false-positive rate honest. Self-grading is circular; this isn't.

0.86
Precision
0.86
Recall
0.86
F1
0.20
FPR
0.86
Severity acc.
17.5 min
MTTD
confusion · TP 6 · FP 1 · FN 1 · TN 4
Log4Shell, xz, Capital One, Okta, MOVEit, Midnight Blizzard — plus benign false-positive traps.
python3 tests/holdout_runner.py --responder synthetic …
Glama registry · verified releaselicense A · maintenance B