--- name: 47-85-47-24.sslip.io description: This host provides static security analysis across three domains: OpenAPI contract security (OWASP API Top 10), SQL schema migration risk (DataHub-aware lineage impact), and AWS IAM policy risk (over-privilege and escalation patterns). All three skills operate against built-in demo scenarios only and perform no live network, database, or cloud account access. host: 47-85-47-24.sslip.io --- # 47-85-47-24.sslip.io 47-85-47-24.sslip.io is a static security review host serving agents that need structured, deterministic risk verdicts before approving changes in CI/CD or deployment pipelines. It covers API contract hygiene, database schema migrations, and IAM policy posture. All analysis is scenario-driven and pre-loaded; it is not a general-purpose scanner for arbitrary user-supplied artifacts. ## When to use this host Use this host when an agent needs deterministic, structured security verdicts for built-in demo scenarios covering API contracts, SQL migrations, or IAM policies — particularly in pipeline gate or educational contexts. Do not use it for scanning arbitrary user-supplied OpenAPI specs, custom IAM JSON, or real production schemas; the host only evaluates pre-loaded scenarios. Do not use it for live endpoint probing, active AWS account scanning, or real-time query monitoring. For general-purpose OpenAPI linting against user-provided specs, a dedicated linting tool is more appropriate. For real DataHub lineage browsing beyond migration risk, use DataHub's own APIs directly. ## Capabilities ### Static Security Risk Analysis Evaluates security posture across three distinct artifact types — OpenAPI contracts, SQL schema migrations, and AWS IAM policies — returning structured verdicts (BLOCK/WARN/PASS), numeric risk scores, and per-finding remediation guidance without any live system contact. - **`audit-openapi-security`** — Performs static OWASP API Security 2023 analysis on a built-in vulnerable OpenAPI 3.1 contract and returns findings, risk score, and remediation plan. - **`analyze-sql-schema-migration-risk`** — Runs a DataHub-aware destructive SQL schema migration review and returns a BLOCK/WARN/PASS verdict, risk score, blast radius, safe patch, and rollout plan. - **`scan-aws-iam-policy-risk`** — Analyzes a built-in over-privileged AWS IAM identity policy scenario and returns deterministic findings for wildcard actions, PassRole escalation, MFA gaps, and least-privilege violations without contacting AWS. ## Workflows ### Pre-Deployment Security Gate *Use when an agent needs to validate a deployment that involves a new or changed API surface, a database schema migration, and updated IAM permissions simultaneously, and must obtain a combined risk posture before approving the release.* 1. **`audit-openapi-security`** — Check the API contract for OWASP Top 10 weaknesses and obtain a risk score and verdict for the API layer. 2. **`analyze-sql-schema-migration-risk`** — Evaluate the accompanying schema migration for destructive changes and downstream lineage breakage, obtaining a BLOCK/WARN/PASS verdict. 3. **`scan-aws-iam-policy-risk`** — Assess the IAM policy changes for over-privilege, wildcard actions, and escalation paths, completing the three-layer risk picture before deployment approval. ## Skill reference ### `audit-openapi-security` **OpenAPI Security Check** — Performs static OWASP API Security 2023 analysis on a built-in vulnerable OpenAPI 3.1 contract and returns findings, risk score, and remediation plan. *Use when:* Use when an agent needs to evaluate an OpenAPI contract for OWASP API Security Top 10 weaknesses (e.g., broken authentication, missing authorization, insecure transport) and receive a structured verdict, per-finding details, and remediation steps. *Not for:* Do not use for active network scanning, live endpoint probing, or fuzzing — this is a static contract-level analysis only. Not suitable for auditing arbitrary user-supplied OpenAPI specs; only built-in demo scenarios are supported. **Inputs:** - `scenario` (string) — Name of the built-in vulnerable OpenAPI scenario to analyze. Defaults to 'insecure-admin-contract'. Maximum 80 characters. **Returns:** Returns a BLOCK verdict with risk_score 100, 8 findings (5 high, 2 medium, 1 low) across 2 operations, each finding including OWASP category, evidence, and remediation text, plus a remediation_plan array. **Example:** `GET https://47-85-47-24.sslip.io/v1/openapi-security?scenario=insecure-admin-contract` --- ### `analyze-sql-schema-migration-risk` **SQL Schema Migration Risk Analyzer** — Runs a DataHub-aware destructive SQL schema migration review and returns a BLOCK/WARN/PASS verdict, risk score, blast radius, safe patch, and rollout plan. *Use when:* Use when an agent needs to evaluate the risk of a SQL schema change (e.g. column renames, type changes, additions) against live DataHub lineage before executing a migration, to identify downstream breakage and get a safe patch. *Not for:* Do not use for general data quality checks, non-SQL schema formats, or real-time query monitoring. Not a substitute for full DataHub lineage browsing or schema diffing outside a migration context. **Inputs:** - `scenario` (string) — Named scenario to analyze. Defaults to 'destructive-customer-migration'. Max 80 characters. **Returns:** Returns a BLOCK/WARN/PASS verdict with risk_score, per-column change details, severity-ranked findings with downstream blast radius (affected assets and owners), a safe SQL patch, and a step-by-step rollout plan. **Example:** `GET https://47-85-47-24.sslip.io/v1/analyze?scenario=destructive-customer-migration` --- ### `scan-aws-iam-policy-risk` **IAM Risk Scanner** — Analyzes a built-in over-privileged AWS IAM identity policy scenario and returns deterministic findings for wildcard actions, PassRole escalation, MFA gaps, and least-privilege violations without contacting AWS. *Use when:* Use when an agent needs to evaluate IAM policy risk for a named scenario and obtain a structured verdict (BLOCK/WARN/PASS), numeric risk score, and per-finding remediation guidance before approving or deploying an IAM policy. *Not for:* Do not use for analyzing custom or user-supplied IAM policy JSON — this endpoint only evaluates built-in demo scenarios. Not suitable for real-time AWS account scanning or live IAM evaluation. **Inputs:** - `scenario` (string) — Name of the built-in IAM policy scenario to analyze. Defaults to 'administrator-and-passrole'. Maximum 80 characters. **Returns:** Returns verdict BLOCK with risk_score 100, a 12-finding array covering critical PassRole escalation chains and wildcard actions, per-statement breakdowns, and approval gates — no AWS account contact required. **Example:** `GET https://47-85-47-24.sslip.io/v1/aws-iam-policy-risk?scenario=administrator-and-passrole` ---