Cloud posture as a workflow, not a monthly report.

inputs:
  accounts: list<CloudAccount>

steps:
  audit:
    action: cloud.audit
    forEach: inputs.accounts
    with: { connection: item.connection }
    maxConcurrency: 2

  public_resources:
    refine: filter(audit.output.findings, item.publicReachable == true)

  verify_reachability:
    action: http.get
    forEach: public_resources.output.filter(item.resourceUrl ne null)
    with: { url: item.resourceUrl }

  write_findings:
    action: findings.record
    forEach: audit.output.findings

  summary:
    action: slack.post
    condition: audit.output.findings.filter(item.severity in ["critical", "high"]) ne []
    with:
      channel: "#cloud-security"
      summary: templates.posture_report.render(audit.output, verify_reachability.output)
      runUrl: run.url

Scheduled nightly, this runbook deduplicates findings across runs. A publicly-readable bucket seen again tonight does not create a new finding — it bumps the observation count on the existing one. Only genuinely new exposures reach Slack.

• Compliance-framework mapping (SOC 2, ISO 27001, HIPAA, PCI DSS). Skydra produces evidence; framework mapping is operator-owned.
• Multi-cloud cost analysis. Posture, not spend.
• Agent-based runtime detection (eBPF, host IDS). Skydra audits configuration and observable behavior, not kernel-level activity.
• Container image CVE scanning as a primary feature. Skydra probes container registry exposure and anonymous pulls; CVE scanning is a different product category.
• SIEM/XDR ingestion. Skydra produces evidence; downstream aggregation is a connection, not a core capability.