orca-impact-analysis

# Orca Impact Analysis Skill Answers two questions: 1. **"If I fix this, what else closes?"** — alerts, attack paths, compliance controls resolved 2. **"If I fix this, what might break?"** — production workflows, automation, and services that depend on the current (insecure) state Given a single Orca alert, this skill analyzes BOTH sides of remediation impact — the security improvements AND the operational risk of applying the fix. ## Usage ``` /orca-impact-analysis <alert-id> /orca-impact-analysis orca-3380725 ``` Or natural language: - "what's the impact of fixing orca-3380725?" - "if I fix orca-3511464, what else closes?" - "impact analysis for orca-3213766" - "what does remediation of orca-3380725 resolve?" ## What This Skill Does 1. **Fetches the alert** and identifies the root cause and fix action 2. **Queries same-asset alerts** to find co-located findings that share the same root cause 3. **Queries attack paths** to find kill chains that break when this alert is fixed 4. **Queries similar alert type** across the environment to find the same issue on other assets 5. **Checks compliance impact** to find frameworks/controls that would pass after the fix 6. **Simulates breakage risk** using CloudTrail/CDR events, effective permissions, and usage patterns to identify production workflows that depend on the current state 7. **Synthesizes a full impact report** with security gains AND operational risks ## Processing Logic ### Step 1: Understand the Fix Fetch the al...