azure-storage-exposure-auditor

What This Skill Does

The Azure Storage & Blob Exposure Auditor is a specialized diagnostic skill for OpenClaw designed to help security teams identify and remediate data exposure vulnerabilities within Microsoft Azure environments. Public blob containers represent one of the most frequent vectors for data breaches. This skill analyzes your Azure infrastructure configuration to pinpoint misconfigurations that could lead to unauthorized data access. By ingesting metadata from your storage accounts—such as network rules, public access settings, and blob-level permissions—it creates a comprehensive security posture report. It does not perform any changes to your infrastructure or store credentials; it serves as an analytical layer for security best practices.

Installation

To integrate this auditing capability into your OpenClaw environment, execute the following command in your terminal: clawhub install openclaw/skills/skills/anmolnagpal/storage-exposure-auditor

Use Cases

• Compliance Auditing: Automatically verify if all storage accounts in production comply with organizational policies, such as the requirement for HTTPS traffic and private endpoints.
• Threat Mitigation: Quickly assess the blast radius of a potentially public container found during a penetration test.
• Hardening Strategy: Use the generated Bicep and ARM templates to systematically remediate insecure configurations at scale.
• Ransomware Preparedness: Audit storage accounts for missing soft delete or versioning features that are critical for recovering data after an attack.

Example Prompts

1. "I have attached my storage account list and container audit logs. Which ones are publicly exposed to the internet and what is the data sensitivity risk?"
2. "Review my storage account network rules. Are there any accounts missing private endpoints that should be restricted to our VNet?"
3. "Please generate a hardening policy using Bicep for all my storage accounts that currently allow public blob access."

Tips & Limitations

This skill is strictly an instruction-based analytical tool and does not execute Azure CLI commands directly against your subscription. To maximize accuracy, ensure that the data you provide includes both account-level configuration (e.g., allowBlobPublicAccess) and container-level settings. For the best security outcomes, combine these findings with Azure Policy to enforce 'deny' rules across your subscriptions, ensuring that misconfigurations cannot be introduced in the future. Always rotate your shared access keys regularly as per the recommended 90-day cycle.