prowler-attack-paths-query
Installation
SKILL.md
Overview
Attack Paths queries are read-only openCypher queries over a Cartography-ingested cloud graph that detect privilege escalation chains, network exposure, and other graph-shaped security risks. Queries are written in openCypher Version 9 so they run on both Neo4j and Amazon Neptune sinks.
This skill is the concise, action-oriented reference for building queries. For the complete human-readable reference (graph model, list-typed and JSON-encoded properties, compatibility, and worked examples), see docs/developer-guide/attack-paths-queries.mdx.
Two query audiences
| Predefined queries | Custom queries | |
|---|---|---|
| Where they live | api/src/backend/api/attack_paths/queries/{provider}.py |
User-supplied via the custom query API endpoint |
| Provider isolation | AWSAccount {id: $provider_uid} anchor + path connectivity |
Automatic _Provider_{uuid} label injection by cypher_sanitizer.py |
| What to write | Chain every MATCH from the aws variable |
Plain Cypher, no isolation boilerplate |
| Internal labels | Never use | Never use (system-injected) |
Predefined queries: every node must be reachable from the AWSAccount root via graph traversal. That is the isolation boundary.