---

name: mesh-security description: Analyze Istio, Consul, and Linkerd service mesh configurations for security vulnerabilities with NIST 800-53 control mappings. Use when users need to audit mesh security, identify misconfigurations, check mTLS settings, review ACL policies, or prepare for FedRAMP assessments. Triggers on keywords like "mesh config", "istio security", "consul ACL", "linkerd policy", "service mesh audit", or "NIST compliance". license: MIT metadata: author: mesh-config-analyzer version: "1.0.0"

Service Mesh Security Analyzer

Comprehensive security analysis for Istio, Consul, and Linkerd service mesh configurations with NIST 800-53 Rev 5 control mappings.

Quick Start

Analyze a Configuration File

Copy# Run the analyzer wrapper directly
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js <config-file>

# Examples
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-meshconfig.yaml
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./consul-config.json
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./linkerd-config.yaml --json

Sample Configurations

Test configs are available in the samples/ directory:

• Istio: samples/sample-meshconfig.yaml
• Consul: samples/sample-consul-config.json
• Linkerd: samples/sample-linkerd-config.yaml

Supported Mesh Types

Istio

Auto-detection: Files with kind: MeshConfig and apiVersion containing istio.io

Security Checks:

Consul

Auto-detection: Files with mesh_type: "consul" or containing connect, tls, and acl fields

Security Checks:

Linkerd

Auto-detection: Files with mesh_type: "linkerd" or containing identity, proxy, and policy fields

Security Checks:

Severity Levels

NIST 800-53 Control Mappings

Findings are mapped to these NIST 800-53 Rev 5 controls:

Workflow: Analyze a Mesh Configuration

1. Read the configuration file to understand its structure
2. Run the analyzer using the wrapper script
3. Review findings by severity (Critical first)
4. Check NIST mappings for compliance requirements
5. Generate remediation recommendations if needed

Example Analysis Session

CopyUser: Analyze my Istio mesh configuration at ./istio-config.yaml

Steps:
1. Read the file to understand the mesh configuration
2. Run: node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-config.yaml
3. Present findings grouped by severity
4. Highlight critical/high severity issues first
5. Include NIST control mappings for compliance context
6. Offer to generate fixes or compliance report

Output Format

Markdown (Default)

Copy## Security Analysis Results

**Mesh Type:** Istio
**File:** ./istio-config.yaml
**Total Findings:** 5

| Severity | Count |
|----------|-------|
| Critical | 1     |
| High     | 2     |
| Medium   | 2     |
| Low      | 0     |

### Critical Findings

#### 1. mTLS Configuration
**Issue:** mTLS is not set to STRICT mode
**Location:** `spec.mtls.mode`
**Recommendation:** Set mTLS mode to STRICT to enforce mutual TLS
**NIST Controls:** SC-8, SC-13

JSON (--json flag)

Copy{
  "success": true,
  "meshType": "istio",
  "findings": [...],
  "summary": { "critical": 1, "high": 2, "medium": 2, "low": 0, "total": 5 }
}

Related Skills

• mesh-remediation - Generate and apply security fixes
• mesh-compliance-reporter - Generate FedRAMP/NIST compliance reports

Programmatic Usage

Copyconst { analyzeConfig, formatFindings } = require('~/.claude/skills/mesh-security/lib/analyzer-wrapper.js');

// Analyze a config file
const results = analyzeConfig('./istio-config.yaml');
console.log(formatFindings(results));

// Or specify mesh type explicitly
const consulResults = analyzeConfig('./config.json', 'consul');