name: mesh-security
description: Analyze Istio, Consul, and Linkerd service mesh configurations for security vulnerabilities with NIST 800-53 control mappings. Use when users need to audit mesh security, identify misconfigurations, check mTLS settings, review ACL policies, or prepare for FedRAMP assessments. Triggers on keywords like "mesh config", "istio security", "consul ACL", "linkerd policy", "service mesh audit", or "NIST compliance".
license: MIT
metadata:
author: mesh-config-analyzer
version: "1.0.0"

Service Mesh Security Analyzer

Comprehensive security analysis for Istio, Consul, and Linkerd service mesh configurations with NIST 800-53 Rev 5 control mappings.

Quick Start

Analyze a Configuration File

# Run the analyzer wrapper directly
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js <config-file>

# Examples
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-meshconfig.yaml
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./consul-config.json
node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./linkerd-config.yaml --json

Sample Configurations

Test configs are available in the samples/ directory:
- Istio: samples/sample-meshconfig.yaml
- Consul: samples/sample-consul-config.json
- Linkerd: samples/sample-linkerd-config.yaml

Supported Mesh Types

Istio

Auto-detection: Files with kind: MeshConfig and apiVersion containing istio.io

Security Checks:
| Category | What It Checks |
|----------|----------------|
| mTLS | Enabled status, STRICT mode enforcement |
| Certificates | CA provider, validity duration (optimal 90 days) |
| Peer Authentication | Default peer auth, STRICT mode |
| Proxy Config | Privileged mode, image versioning, holdApplicationUntilProxyStarts |
| Secret Discovery | SDS enabled for certificate management |
| Trust Domain | Explicitly configured, not using default |
| Authorization | Default deny policies |
| Telemetry | Enabled collection, access logging |
| RBAC | Role-based access control enforcement |
| Traffic Policy | Outbound traffic restricted to REGISTRY_ONLY |

Consul

Auto-detection: Files with mesh_type: "consul" or containing connect, tls, and acl fields

Security Checks:
| Category | What It Checks |
|----------|----------------|
| Service Mesh | Connect enabled |
| Proxy Security | No privileged mode |
| TLS Security | verify_incoming, verify_outgoing, hostname verification |
| Access Control | ACL enabled, default deny policy, agent tokens |
| Telemetry | Service metrics enabled |
| Auto-Encryption | TLS auto-encrypt feature |
| Gossip Encryption | Key configured, proper length, verification |
| FedRAMP Compliance | TLS 1.2+, FIPS ciphers, strong encryption |

Linkerd

Auto-detection: Files with mesh_type: "linkerd" or containing identity, proxy, and policy fields

Security Checks:
| Category | What It Checks |
|----------|----------------|
| TLS Security | Enabled, enforced, cipher suites, min version 1.2 |
| Service Identity | Enabled, certificate issuer, validity period |
| Proxy Config | Non-privileged, versioning, timeouts, resource limits |
| Authorization | Policy enforcement, default deny, specific rules |
| Authentication | Strict mode enforcement |
| Observability | Tracing enabled, sampling, collector config |
| Metrics | Enabled, Prometheus integration, retention |
| Traffic Rules | TLS in destination rules, system namespace protection |

Severity Levels

NIST 800-53 Control Mappings

Findings are mapped to these NIST 800-53 Rev 5 controls:

Workflow: Analyze a Mesh Configuration

1. Read the configuration file to understand its structure
2. Run the analyzer using the wrapper script
3. Review findings by severity (Critical first)
4. Check NIST mappings for compliance requirements
5. Generate remediation recommendations if needed

Example Analysis Session

User: Analyze my Istio mesh configuration at ./istio-config.yaml

Steps:
1. Read the file to understand the mesh configuration
2. Run: node ~/.claude/skills/mesh-security/lib/analyzer-wrapper.js ./istio-config.yaml
3. Present findings grouped by severity
4. Highlight critical/high severity issues first
5. Include NIST control mappings for compliance context
6. Offer to generate fixes or compliance report

Output Format

Markdown (Default)

## Security Analysis Results

**Mesh Type:** Istio
**File:** ./istio-config.yaml
**Total Findings:** 5

| Severity | Count |
|----------|-------|
| Critical | 1     |
| High     | 2     |
| Medium   | 2     |
| Low      | 0     |

### Critical Findings

#### 1. mTLS Configuration
**Issue:** mTLS is not set to STRICT mode
**Location:** `spec.mtls.mode`
**Recommendation:** Set mTLS mode to STRICT to enforce mutual TLS
**NIST Controls:** SC-8, SC-13

JSON (--json flag)

{
  "success": true,
  "meshType": "istio",
  "findings": [...],
  "summary": { "critical": 1, "high": 2, "medium": 2, "low": 0, "total": 5 }
}

Related Skills

• mesh-remediation - Generate and apply security fixes
• mesh-compliance-reporter - Generate FedRAMP/NIST compliance reports

Programmatic Usage

const { analyzeConfig, formatFindings } = require('~/.claude/skills/mesh-security/lib/analyzer-wrapper.js');

// Analyze a config file
const results = analyzeConfig('./istio-config.yaml');
console.log(formatFindings(results));

// Or specify mesh type explicitly
const consulResults = analyzeConfig('./config.json', 'consul');