Habilidades terraform-skill
📦

terraform-skill

v1.17.1 Revisión del contenido r1 Crítico ⚙️ Comandos externos📁 Acceso al sistema de archivos🔑 Variables de entorno⚡ Contiene scripts🌐 Acceso a red

Build Safer Terraform and OpenTofu Workflows

Terraform changes can expose secrets, replace resources, or corrupt shared state. This skill diagnoses those risks and provides version-aware implementation and validation guidance.

Compatible con: Claude Codex Code(CC)
⚠️ 38 Deficiente

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente
Review the Skillstore skill "terraform-skill" from https://skillstore.io/skills/antonbabenko-terraform-skill.md and its manifest at https://skillstore.io/api/skills/antonbabenko-terraform-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/antonbabenko-terraform-skill.md Manifest firmado GET /api/skills/antonbabenko-terraform-skill/manifest Lockfile firmado GET /api/skills/antonbabenko-terraform-skill/lockfile

Pruébalo

Usando "terraform-skill". A module changed from count to for_each and the plan replaces production instances.

Resultado esperado:

  • Risk: resource identity churn can cause unintended replacement.
  • Recommendation: map old addresses to stable keys with migration blocks.
  • Validation: review a saved plan and confirm zero unexpected destroys before approval.

Usando "terraform-skill". A team wants Terraform to read a database password from a standard variable.

Resultado esperado:

  • Risk: sensitive variables remain in Terraform state even when display is masked.
  • Recommendation: use supported write-only or ephemeral mechanisms, or keep secret material outside Terraform.
  • Validation: inspect the plan and state handling without printing the secret.

Usando "terraform-skill". A CI job plans again during apply after the pull request plan was approved.

Resultado esperado:

  • Risk: the applied configuration can differ from the reviewed plan.
  • Recommendation: store the approved plan securely and apply that exact artifact.
  • Validation: require protected-environment approval and verify artifact provenance.

Auditoría de seguridad

Crítico
v1 • 13/8/2026 Abrir el informe versionado

The skill has defensive intent and requires reviewed plans, confirmation for destroy operations, and state-secret safeguards. Most static matches are Markdown syntax, Terraform identifiers, placeholders, or labeled examples rather than executable threats. Confirmed risks are an unverified pipe-to-shell installer, its mutable source URL, fragile xargs deletion, an unpinned action, and direct auto-approved apply examples.

9
Archivos escaneados
6,669
Líneas analizadas
2
Elementos de revisión
0
Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (3)

Crítico
references/security-compliance.md:43
Pipe to shell pattern
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b
The installation example pipes a mutable remote script directly into sh without checksum or signature verification. A compromised upstream response would gain immediate code execution.
Alto
references/security-compliance.md:46
Unpinned GitHub Action
The Trivy CI example uses aquasecurity/trivy-action@master. A mutable branch reference can change without review and execute compromised action code with workflow permissions.
The source directly uses the mutable master ref, while another reference file demonstrates a pinned Trivy action version.
Alto
references/state-management.md:583references/state-management.md:606references/state-management.md:615
Direct Auto-Approved Infrastructure Apply
State-locking examples run terraform apply -auto-approve without applying a reviewed saved plan. Reusing this guidance can bypass change review and mutate infrastructure unexpectedly.
Three operational examples invoke direct auto-approved applies, contrary to the core requirement to apply a reviewed plan artifact.
Elementos de revisión de capacidades (2)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto
references/security-compliance.md:43
Hardcoded URL
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b
This URL supplies the script executed by the pipe-to-shell command on the same line. It references a mutable branch path and provides no integrity verification.
Medio
references/state-management.md:1184
xargs command (can execute arbitrary commands)
ls -t $BACKUP_DIR/terraform.tfstate.* | tail -n +31 | xargs rm -f
The backup cleanup pipes parsed ls output into xargs rm and leaves BACKUP_DIR unquoted. Spaces or crafted filenames can split arguments and remove unintended files.

Factores de riesgo

⚙️ Comandos externos (50)
references/ci-cd-workflows.md:355-360 references/ci-cd-workflows.md:388-410 references/ci-cd-workflows.md:269 references/ci-cd-workflows.md:282 references/ci-cd-workflows.md:261 references/quick-reference.md:95 references/state-management.md:289-290 references/state-management.md:290-294 references/state-management.md:489-490 references/state-management.md:490 references/state-management.md:1174 references/state-management.md:1181 references/state-management.md:1713-1715 references/state-management.md:579 references/state-management.md:1177 references/state-management.md:1709 references/state-management.md:1184 references/testing-frameworks.md:100 SKILL.md:18 SKILL.md:21 SKILL.md:26 SKILL.md:34 SKILL.md:42 SKILL.md:45 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:76-80 SKILL.md:80-82 SKILL.md:82-88 SKILL.md:88 SKILL.md:89-90 SKILL.md:90 SKILL.md:91 SKILL.md:97 SKILL.md:98 SKILL.md:108 SKILL.md:109 SKILL.md:110-120 SKILL.md:120-121 SKILL.md:121-122 SKILL.md:122 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-136 SKILL.md:136-140 SKILL.md:140 SKILL.md:148-160 SKILL.md:160-162
📁 Acceso al sistema de archivos (28)
references/ci-cd-workflows.md:3 references/ci-cd-workflows.md:242 references/ci-cd-workflows.md:600 references/ci-cd-workflows.md:406 references/ci-cd-workflows.md:136 references/ci-cd-workflows.md:141 references/code-patterns.md:3 references/code-patterns.md:6 references/code-patterns.md:1064 references/module-patterns.md:3 references/module-patterns.md:6 references/module-patterns.md:81 references/module-patterns.md:85 references/module-patterns.md:90 references/module-patterns.md:251 references/module-patterns.md:322 references/module-patterns.md:337 references/module-patterns.md:779 references/quick-reference.md:3 references/quick-reference.md:771 references/security-compliance.md:3 references/security-compliance.md:648 references/state-management.md:3 references/state-management.md:1834 references/testing-frameworks.md:3 references/testing-frameworks.md:6 references/testing-frameworks.md:405 references/testing-frameworks.md:518
🔑 Variables de entorno (20)
references/ci-cd-workflows.md:130 references/code-patterns.md:599 references/code-patterns.md:603 references/code-patterns.md:604 references/code-patterns.md:616 references/code-patterns.md:630 references/code-patterns.md:951 references/code-patterns.md:956 references/code-patterns.md:963 references/code-patterns.md:973 references/quick-reference.md:439 references/quick-reference.md:440 references/security-compliance.md:402 references/security-compliance.md:403 references/security-compliance.md:102 references/security-compliance.md:107 references/security-compliance.md:387 references/state-management.md:841 references/state-management.md:856 references/state-management.md:861
⚡ Contiene scripts (2)
references/code-patterns.md:401 references/testing-frameworks.md:394-399
🌐 Acceso a red (19)
references/code-patterns.md:437 references/code-patterns.md:1007 references/code-patterns.md:1014 references/code-patterns.md:1021 references/module-patterns.md:324 references/security-compliance.md:43 references/security-compliance.md:66 references/security-compliance.md:136 references/security-compliance.md:142 references/security-compliance.md:187 references/security-compliance.md:201 references/security-compliance.md:219 references/security-compliance.md:226 references/security-compliance.md:248 references/security-compliance.md:254 references/security-compliance.md:258 references/security-compliance.md:273 references/testing-frameworks.md:27 SKILL.md:187

Patrones detectados

Pipe to shell pattern
Auditado por: codex
Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado
Evaluación de seguridad

Copiar enlace del informe

https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg)](https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/antonbabenko-terraform-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citas académicas (APA · BibTeX · CFF)

Cita APA

antonbabenko. (2026). terraform-skill security audit report (audit version 1) [Author version 1.17.1]. Skillstore. https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1

Cita BibTeX

@techreport{antonbabenko-antonbabenko-terraform-skill-2026, author = {antonbabenko}, title = {terraform-skill security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1}, note = {Author version 1.17.1} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "terraform-skill security audit report (audit version 1)" version: "1.17.1" type: report authors: - name: "antonbabenko" date-released: "2026-08-13" url: "https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1" identifiers: - type: other value: "skillstore:antonbabenko-terraform-skill:audit:1" description: "Skillstore immutable audit report identifier"

Comparar variantes

2 variantes instalables

Cada autor sigue siendo un skill instalable independiente. La variante recomendada se ordena según la evidencia de Skillstore.

Por qué esta variante es la primera

Mayor puntuación de Skillstore
Anton Babenko Recomendado

sickn33-terraform-skill

Puntuación de Skillstore 80
Confianza de la evidencia Alto
Uso en Skillstore 17
Actualizado

2026-09-09

antonbabenko Actual

antonbabenko-terraform-skill

Puntuación de Skillstore 38
Confianza de la evidencia Bajo
Uso en Skillstore 6
Actualizado

2026-09-09

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Bajo
45
Arquitectura
100
Mantenibilidad
87
Contenido
65
Comunidad
91
Cumplimiento de la especificación

Lo que puedes crear

Refactor a Shared Module

Plan address-preserving changes, add migration blocks, and validate that production resources are not replaced.

Build a Controlled Delivery Pipeline

Create validation, testing, policy, plan, approval, and exact-plan apply stages for infrastructure changes.

Recover and Harden Remote State

Investigate locks or drift, select a recovery path, and document backup and rollback evidence.

Prueba estos prompts

Review a Terraform Configuration 
Review this Terraform configuration for correctness and safety. State runtime assumptions, identify risks, propose focused changes, and provide validation steps.
Design a Reusable Module 
Design a reusable [provider] module for [service]. Target [Terraform or OpenTofu version]. Include typed inputs, stable outputs, tests, security controls, and usage guidance.
Create an Infrastructure Pipeline 
Design a CI/CD workflow for this repository. Separate validation, testing, security, plan, approval, and apply stages. Apply only the reviewed plan artifact.
Plan a State Recovery 
Diagnose this [lock, drift, migration, or corruption] incident. Use the supplied backend details and logs to create evidence-preserving recovery and rollback procedures.

Mejores prácticas

  • Provide the runtime, exact version, providers, backend, execution path, and environment criticality.
  • Review saved plans and retain rollback evidence before destructive or state-mutating operations.
  • Pin runtimes, providers, modules, actions, and lockfiles according to the environment risk.

Evitar

  • Do not apply directly to production without a reviewed plan artifact and approval.
  • Do not assume sensitive variables keep secret values out of state.
  • Do not rename resource addresses blindly or use list indexes as durable identity.

Preguntas frecuentes

Does this skill support OpenTofu?
Yes. It provides runtime-specific guidance and asks for the exact Terraform or OpenTofu version before selecting features.
Can it write complete Terraform modules?
Yes. It can propose module structure, typed inputs, stable outputs, version constraints, examples, tests, and validation steps.
Will it run terraform apply automatically?
No. Production changes require a reviewed plan, approval, and an explicit execution decision.
How does it handle secrets?
It explains state exposure and recommends write-only, ephemeral, managed-secret, or external runtime patterns when supported.
Which testing approaches does it cover?
It covers formatting, validation, linting, native tests, mock providers, Terratest, security scanners, and policy checks.
Can it recover corrupted Terraform state?
It can develop a cautious recovery procedure from supplied backend details and evidence. Operators must verify backups and authorize mutations.

Detalles del desarrollador

Licencia

Apache-2.0

Versión del autor

v1.17.1

Revisión de Skillstore

r1

Repositorio

https://github.com/antonbabenko/terraform-skill/tree/0a3a4a66e99001347d36a41e10260a825be3ab62/skills/terraform-skill

Ref.

68046dfc1c93b48a04e43344644ad77d3a895012

Actualidad del mantenimiento

13/8/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📁 references/

📄 ci-cd-workflows.md

📄 code-intelligence-lsp.md

📄 code-patterns.md

📄 module-patterns.md

📄 quick-reference.md

📄 security-compliance.md

📄 state-management.md

📄 testing-frameworks.md

📄 SKILL.md

Habilidades relacionadas

Ver todo