📦

terraform-skill

Name: terraform-skill
Author: antonbabenko

v1.17.1 Révision du contenu r1 Critique ⚙️ Commandes externes📁 Accès au système de fichiers🔑 Variables d’environnement⚡ Contient des scripts🌐 Accès réseau

Build Safer Terraform and OpenTofu Workflows

Terraform changes can expose secrets, replace resources, or corrupt shared state. This skill diagnoses those risks and provides version-aware implementation and validation guidance.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

N’installez pas automatiquement ce Skill.

La politique de référence exige un examen par un opérateur avant toute action d’installation.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "terraform-skill" from https://skillstore.io/skills/antonbabenko-terraform-skill.md and its manifest at https://skillstore.io/api/skills/antonbabenko-terraform-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/antonbabenko-terraform-skill.md manifest signé GET /api/skills/antonbabenko-terraform-skill/manifest lockfile signé GET /api/skills/antonbabenko-terraform-skill/lockfile

Tester

Utilisation de « terraform-skill ». A module changed from count to for_each and the plan replaces production instances.

Résultat attendu:

Risk: resource identity churn can cause unintended replacement.
Recommendation: map old addresses to stable keys with migration blocks.
Validation: review a saved plan and confirm zero unexpected destroys before approval.

Utilisation de « terraform-skill ». A team wants Terraform to read a database password from a standard variable.

Résultat attendu:

Risk: sensitive variables remain in Terraform state even when display is masked.
Recommendation: use supported write-only or ephemeral mechanisms, or keep secret material outside Terraform.
Validation: inspect the plan and state handling without printing the secret.

Utilisation de « terraform-skill ». A CI job plans again during apply after the pull request plan was approved.

Résultat attendu:

Risk: the applied configuration can differ from the reviewed plan.
Recommendation: store the approved plan securely and apply that exact artifact.
Validation: require protected-environment approval and verify artifact provenance.

Audit de sécurité

Critique

v1 • 13/08/2026 Ouvrir le rapport versionné

The skill has defensive intent and requires reviewed plans, confirmation for destroy operations, and state-secret safeguards. Most static matches are Markdown syntax, Terraform identifiers, placeholders, or labeled examples rather than executable threats. Confirmed risks are an unverified pipe-to-shell installer, its mutable source URL, fragile xargs deletion, an unpinned action, and direct auto-approved apply examples.

Fichiers analysés

6,669

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (3)

Critique

references/security-compliance.md:43

Pipe to shell pattern

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

The installation example pipes a mutable remote script directly into sh without checksum or signature verification. A compromised upstream response would gain immediate code execution.

Élevé

references/security-compliance.md:46

Unpinned GitHub Action

The Trivy CI example uses aquasecurity/trivy-action@master. A mutable branch reference can change without review and execute compromised action code with workflow permissions.

The source directly uses the mutable master ref, while another reference file demonstrates a pinned Trivy action version.

Élevé

references/state-management.md:583 references/state-management.md:606 references/state-management.md:615

Direct Auto-Approved Infrastructure Apply

State-locking examples run terraform apply -auto-approve without applying a reviewed saved plan. Reusing this guidance can bypass change review and mutate infrastructure unexpectedly.

Three operational examples invoke direct auto-approved applies, contrary to the core requirement to apply a reviewed plan artifact.

Éléments d’évaluation des capacités (2)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

references/security-compliance.md:43

Hardcoded URL

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

This URL supplies the script executed by the pipe-to-shell command on the same line. It references a mutable branch path and provides no integrity verification.

Moyen

references/state-management.md:1184

xargs command (can execute arbitrary commands)

ls -t $BACKUP_DIR/terraform.tfstate.* | tail -n +31 | xargs rm -f

The backup cleanup pipes parsed ls output into xargs rm and leaves BACKUP_DIR unquoted. Spaces or crafted filenames can split arguments and remove unintended files.

Facteurs de risque

⚙️ Commandes externes (50)

📁 Accès au système de fichiers (28)

🔑 Variables d’environnement (20)

⚡ Contient des scripts (2)

references/code-patterns.md:401 references/testing-frameworks.md:394-399

🌐 Accès réseau (19)

Motifs détectés

Pipe to shell pattern

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg)](https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/antonbabenko-terraform-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

antonbabenko. (2026). terraform-skill security audit report (audit version 1) [Author version 1.17.1]. Skillstore. https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1

Citation BibTeX

@techreport{antonbabenko-antonbabenko-terraform-skill-2026,
  author = {antonbabenko},
  title = {terraform-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1},
  note = {Author version 1.17.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "terraform-skill security audit report (audit version 1)"
version: "1.17.1"
type: report
authors:
  - name: "antonbabenko"
date-released: "2026-08-13"
url: "https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:antonbabenko-terraform-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

Comparer les variantes

2 variantes installables

Chaque auteur reste un skill installable distinct. La variante recommandée est classée selon les preuves Skillstore.

Pourquoi cette variante est première

Meilleur score Skillstore

Auteur / source Score Skillstore Niveau de confiance des preuves Utilisation Skillstore Mis à jour

Anton Babenko Recommandé

sickn33-terraform-skill

Score Skillstore 80

Niveau de confiance des preuves Élevé

Utilisation Skillstore 23

Mis à jour

2026-09-09

antonbabenko Actuelle

antonbabenko-terraform-skill

Score Skillstore 38

Niveau de confiance des preuves Faible

Utilisation Skillstore 11

Mis à jour

2026-10-24

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Faible

Architecture

100

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Refactor a Shared Module

Plan address-preserving changes, add migration blocks, and validate that production resources are not replaced.

Build a Controlled Delivery Pipeline

Create validation, testing, policy, plan, approval, and exact-plan apply stages for infrastructure changes.

Recover and Harden Remote State

Investigate locks or drift, select a recovery path, and document backup and rollback evidence.

Essayez ces prompts

Review a Terraform Configuration

Review this Terraform configuration for correctness and safety. State runtime assumptions, identify risks, propose focused changes, and provide validation steps.

Design a Reusable Module

Design a reusable [provider] module for [service]. Target [Terraform or OpenTofu version]. Include typed inputs, stable outputs, tests, security controls, and usage guidance.

Create an Infrastructure Pipeline

Design a CI/CD workflow for this repository. Separate validation, testing, security, plan, approval, and apply stages. Apply only the reviewed plan artifact.

Plan a State Recovery

Diagnose this [lock, drift, migration, or corruption] incident. Use the supplied backend details and logs to create evidence-preserving recovery and rollback procedures.

Bonnes pratiques

Provide the runtime, exact version, providers, backend, execution path, and environment criticality.
Review saved plans and retain rollback evidence before destructive or state-mutating operations.
Pin runtimes, providers, modules, actions, and lockfiles according to the environment risk.

Éviter

Do not apply directly to production without a reviewed plan artifact and approval.
Do not assume sensitive variables keep secret values out of state.
Do not rename resource addresses blindly or use list indexes as durable identity.