Orca Config Origin Skill

Answers the question: "Who did this, how was it deployed, and what introduced the issue?"

Given any Orca alert (misconfiguration, vulnerability, sensitive data, or anomaly), traces back through cloud audit logs, Orca CodeOrigins, and asset metadata to find:

1. Who created or modified the resource (identity, role, account)
2. How it was deployed (Terraform, CloudFormation, Pulumi, CDK, Console, CLI, SDK)
3. What introduced the specific issue (the IaC code, AMI, container image, user action, or automation that caused the alert)
4. When — a full timeline from resource creation → issue introduction → alert detection
5. Where — source code file, CI/CD pipeline, or manual action that should be fixed

Usage

/orca-config-origin <alert-id>
/orca-config-origin orca-3380725