📦

terraform-skill

Name: terraform-skill
Author: antonbabenko

v1.17.1 مراجعة المحتوى r1 حرج ⚙️ الأوامر الخارجية📁 الوصول إلى نظام الملفات🔑 متغيرات البيئة⚡ يحتوي على سكربتات🌐 الوصول إلى الشبكة

Build Safer Terraform and OpenTofu Workflows

Terraform changes can expose secrets, replace resources, or corrupt shared state. This skill diagnoses those risks and provides version-aware implementation and validation guidance.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

لا تثبّت هذا Skill تلقائيًا.

تتطلب السياسة المعتمدة مراجعة المشغّل قبل أي إجراء تثبيت.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "terraform-skill" from https://skillstore.io/skills/antonbabenko-terraform-skill.md and its manifest at https://skillstore.io/api/skills/antonbabenko-terraform-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/antonbabenko-terraform-skill.md manifest موقَّع GET /api/skills/antonbabenko-terraform-skill/manifest lockfile موقَّع GET /api/skills/antonbabenko-terraform-skill/lockfile

اختبرها

جارٍ استخدام "terraform-skill". A module changed from count to for_each and the plan replaces production instances.

النتيجة المتوقعة:

Risk: resource identity churn can cause unintended replacement.
Recommendation: map old addresses to stable keys with migration blocks.
Validation: review a saved plan and confirm zero unexpected destroys before approval.

جارٍ استخدام "terraform-skill". A team wants Terraform to read a database password from a standard variable.

النتيجة المتوقعة:

Risk: sensitive variables remain in Terraform state even when display is masked.
Recommendation: use supported write-only or ephemeral mechanisms, or keep secret material outside Terraform.
Validation: inspect the plan and state handling without printing the secret.

جارٍ استخدام "terraform-skill". A CI job plans again during apply after the pull request plan was approved.

النتيجة المتوقعة:

Risk: the applied configuration can differ from the reviewed plan.
Recommendation: store the approved plan securely and apply that exact artifact.
Validation: require protected-environment approval and verify artifact provenance.

التدقيق الأمني

حرج

v1 • ١٣‏/٨‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

The skill has defensive intent and requires reviewed plans, confirmation for destroy operations, and state-secret safeguards. Most static matches are Markdown syntax, Terraform identifiers, placeholders, or labeled examples rather than executable threats. Confirmed risks are an unverified pipe-to-shell installer, its mutable source URL, fragile xargs deletion, an unpinned action, and direct auto-approved apply examples.

الملفات التي تم فحصها

6,669

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (3)

حرج

references/security-compliance.md:43

Pipe to shell pattern

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

The installation example pipes a mutable remote script directly into sh without checksum or signature verification. A compromised upstream response would gain immediate code execution.

مرتفع

references/security-compliance.md:46

Unpinned GitHub Action

The Trivy CI example uses aquasecurity/trivy-action@master. A mutable branch reference can change without review and execute compromised action code with workflow permissions.

The source directly uses the mutable master ref, while another reference file demonstrates a pinned Trivy action version.

مرتفع

references/state-management.md:583 references/state-management.md:606 references/state-management.md:615

Direct Auto-Approved Infrastructure Apply

State-locking examples run terraform apply -auto-approve without applying a reviewed saved plan. Reusing this guidance can bypass change review and mutate infrastructure unexpectedly.

Three operational examples invoke direct auto-approved applies, contrary to the core requirement to apply a reviewed plan artifact.

عناصر مراجعة القدرات (2)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

مرتفع

references/security-compliance.md:43

Hardcoded URL

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

This URL supplies the script executed by the pipe-to-shell command on the same line. It references a mutable branch path and provides no integrity verification.

متوسط

references/state-management.md:1184

xargs command (can execute arbitrary commands)

ls -t $BACKUP_DIR/terraform.tfstate.* | tail -n +31 | xargs rm -f

The backup cleanup pipes parsed ls output into xargs rm and leaves BACKUP_DIR unquoted. Spaces or crafted filenames can split arguments and remove unintended files.

عوامل الخطر

⚙️ الأوامر الخارجية (50)

📁 الوصول إلى نظام الملفات (28)

🔑 متغيرات البيئة (20)

⚡ يحتوي على سكربتات (2)

references/code-patterns.md:401 references/testing-frameworks.md:394-399

🌐 الوصول إلى الشبكة (19)

الأنماط المكتشفة

Pipe to shell pattern

دقّقه: codex

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg)](https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/antonbabenko-terraform-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

antonbabenko. (2026). terraform-skill security audit report (audit version 1) [Author version 1.17.1]. Skillstore. https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1

اقتباس BibTeX

@techreport{antonbabenko-antonbabenko-terraform-skill-2026,
  author = {antonbabenko},
  title = {terraform-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1},
  note = {Author version 1.17.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "terraform-skill security audit report (audit version 1)"
version: "1.17.1"
type: report
authors:
  - name: "antonbabenko"
date-released: "2026-08-13"
url: "https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:antonbabenko-terraform-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

مقارنة المتغيرات

2 متغيرات قابلة للتثبيت

تبقى مهارة كل مؤلف عنصراً مستقلاً قابلاً للتثبيت. يُرتب المتغير الموصى به وفق أدلة Skillstore.

سبب تصدر هذا المتغير

أعلى تقييم في Skillstore

المؤلف / المصدر تقييم Skillstore موثوقية الأدلة استخدام Skillstore تم التحديث

Anton Babenko موصى به

sickn33-terraform-skill

تقييم Skillstore 80

موثوقية الأدلة مرتفع

استخدام Skillstore 17

تم التحديث

2026-09-09

antonbabenko الحالي

antonbabenko-terraform-skill

تقييم Skillstore 38

موثوقية الأدلة منخفض

استخدام Skillstore 6

تم التحديث

2026-09-09

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: منخفض

الهندسة المعمارية

100

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Refactor a Shared Module

Plan address-preserving changes, add migration blocks, and validate that production resources are not replaced.

Build a Controlled Delivery Pipeline

Create validation, testing, policy, plan, approval, and exact-plan apply stages for infrastructure changes.

Recover and Harden Remote State

Investigate locks or drift, select a recovery path, and document backup and rollback evidence.

جرّب هذه الموجّهات

Review a Terraform Configuration

Review this Terraform configuration for correctness and safety. State runtime assumptions, identify risks, propose focused changes, and provide validation steps.

Design a Reusable Module

Design a reusable [provider] module for [service]. Target [Terraform or OpenTofu version]. Include typed inputs, stable outputs, tests, security controls, and usage guidance.

Create an Infrastructure Pipeline

Design a CI/CD workflow for this repository. Separate validation, testing, security, plan, approval, and apply stages. Apply only the reviewed plan artifact.

Plan a State Recovery

Diagnose this [lock, drift, migration, or corruption] incident. Use the supplied backend details and logs to create evidence-preserving recovery and rollback procedures.

أفضل الممارسات

Provide the runtime, exact version, providers, backend, execution path, and environment criticality.
Review saved plans and retain rollback evidence before destructive or state-mutating operations.
Pin runtimes, providers, modules, actions, and lockfiles according to the environment risk.

تجنب

Do not apply directly to production without a reviewed plan artifact and approval.
Do not assume sensitive variables keep secret values out of state.
Do not rename resource addresses blindly or use list indexes as durable identity.