スキル terraform-skill

📦

terraform-skill

Name: terraform-skill
Author: antonbabenko

v1.17.1 コンテンツリビジョン r1 重大 ⚙️ 外部コマンド📁 ファイルシステムへのアクセス🔑 環境変数⚡ スクリプトを含む🌐 ネットワークアクセス

Build Safer Terraform and OpenTofu Workflows

Terraform changes can expose secrets, replace resources, or corrupt shared state. This skill diagnoses those risks and provides version-aware implementation and validation guidance.

対応: Claude Codex Code(CC)

⚠️ 38 不十分

この Skill を自動インストールしないでください。

基準ポリシーにより、インストール操作の前にオペレーターのレビューが必要です。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "terraform-skill" from https://skillstore.io/skills/antonbabenko-terraform-skill.md and its manifest at https://skillstore.io/api/skills/antonbabenko-terraform-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/antonbabenko-terraform-skill.md 署名済み manifest GET /api/skills/antonbabenko-terraform-skill/manifest 署名済み lockfile GET /api/skills/antonbabenko-terraform-skill/lockfile

テストする

「terraform-skill」を使用しています。 A module changed from count to for_each and the plan replaces production instances.

期待される結果:

Risk: resource identity churn can cause unintended replacement.
Recommendation: map old addresses to stable keys with migration blocks.
Validation: review a saved plan and confirm zero unexpected destroys before approval.

「terraform-skill」を使用しています。 A team wants Terraform to read a database password from a standard variable.

期待される結果:

Risk: sensitive variables remain in Terraform state even when display is masked.
Recommendation: use supported write-only or ephemeral mechanisms, or keep secret material outside Terraform.
Validation: inspect the plan and state handling without printing the secret.

「terraform-skill」を使用しています。 A CI job plans again during apply after the pull request plan was approved.

期待される結果:

Risk: the applied configuration can differ from the reviewed plan.
Recommendation: store the approved plan securely and apply that exact artifact.
Validation: require protected-environment approval and verify artifact provenance.

セキュリティ監査

重大

v1 • 2026/8/13 バージョン別レポートを開く

The skill has defensive intent and requires reviewed plans, confirmation for destroy operations, and state-secret safeguards. Most static matches are Markdown syntax, Terraform identifiers, placeholders, or labeled examples rather than executable threats. Confirmed risks are an unverified pipe-to-shell installer, its mutable source URL, fragile xargs deletion, an unpinned action, and direct auto-approved apply examples.

スキャンされたファイル

6,669

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (3)

重大

references/security-compliance.md:43

Pipe to shell pattern

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

The installation example pipes a mutable remote script directly into sh without checksum or signature verification. A compromised upstream response would gain immediate code execution.

高

references/security-compliance.md:46

Unpinned GitHub Action

The Trivy CI example uses aquasecurity/trivy-action@master. A mutable branch reference can change without review and execute compromised action code with workflow permissions.

The source directly uses the mutable master ref, while another reference file demonstrates a pinned Trivy action version.

高

references/state-management.md:583 references/state-management.md:606 references/state-management.md:615

Direct Auto-Approved Infrastructure Apply

State-locking examples run terraform apply -auto-approve without applying a reviewed saved plan. Reusing this guidance can bypass change review and mutate infrastructure unexpectedly.

Three operational examples invoke direct auto-approved applies, contrary to the core requirement to apply a reviewed plan artifact.

機能レビュー項目 (2)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

references/security-compliance.md:43

Hardcoded URL

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

This URL supplies the script executed by the pipe-to-shell command on the same line. It references a mutable branch path and provides no integrity verification.

中

references/state-management.md:1184

xargs command (can execute arbitrary commands)

ls -t $BACKUP_DIR/terraform.tfstate.* | tail -n +31 | xargs rm -f

The backup cleanup pipes parsed ls output into xargs rm and leaves BACKUP_DIR unquoted. Spaces or crafted filenames can split arguments and remove unintended files.

リスク要因

⚙️ 外部コマンド (50)

📁 ファイルシステムへのアクセス (28)

🔑 環境変数 (20)

⚡ スクリプトを含む (2)

references/code-patterns.md:401 references/testing-frameworks.md:394-399

🌐 ネットワークアクセス (19)

検出されたパターン

Pipe to shell pattern

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg)](https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/antonbabenko-terraform-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

antonbabenko. (2026). terraform-skill security audit report (audit version 1) [Author version 1.17.1]. Skillstore. https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1

BibTeX形式の引用

@techreport{antonbabenko-antonbabenko-terraform-skill-2026,
  author = {antonbabenko},
  title = {terraform-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1},
  note = {Author version 1.17.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "terraform-skill security audit report (audit version 1)"
version: "1.17.1"
type: report
authors:
  - name: "antonbabenko"
date-released: "2026-08-13"
url: "https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:antonbabenko-terraform-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

バリアントを比較

インストール可能なバリアント 2 件

各作者のスキルは個別のインストール項目として維持されます。推奨バリアントは Skillstore の証拠で順位付けされます。

このバリアントが首位の理由

Skillstore スコアが最高

作者 / ソース Skillstore スコア証拠の信頼度 Skillstore 利用状況更新済み

Anton Babenko 推奨

sickn33-terraform-skill

Skillstore スコア 80

証拠の信頼度高

Skillstore 利用状況 17

更新済み

2026-09-09

antonbabenko 現在

antonbabenko-terraform-skill

Skillstore スコア 38

証拠の信頼度低

Skillstore 利用状況 6

更新済み

2026-09-09

Skillstore スコア

このスコアの理由証拠の信頼度: 低

アーキテクチャ

100

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Refactor a Shared Module

Plan address-preserving changes, add migration blocks, and validate that production resources are not replaced.

Build a Controlled Delivery Pipeline

Create validation, testing, policy, plan, approval, and exact-plan apply stages for infrastructure changes.

Recover and Harden Remote State

Investigate locks or drift, select a recovery path, and document backup and rollback evidence.

これらのプロンプトを試す

Review a Terraform Configuration

Review this Terraform configuration for correctness and safety. State runtime assumptions, identify risks, propose focused changes, and provide validation steps.

Design a Reusable Module

Design a reusable [provider] module for [service]. Target [Terraform or OpenTofu version]. Include typed inputs, stable outputs, tests, security controls, and usage guidance.

Create an Infrastructure Pipeline

Design a CI/CD workflow for this repository. Separate validation, testing, security, plan, approval, and apply stages. Apply only the reviewed plan artifact.

Plan a State Recovery

Diagnose this [lock, drift, migration, or corruption] incident. Use the supplied backend details and logs to create evidence-preserving recovery and rollback procedures.

ベストプラクティス

Provide the runtime, exact version, providers, backend, execution path, and environment criticality.
Review saved plans and retain rollback evidence before destructive or state-mutating operations.
Pin runtimes, providers, modules, actions, and lockfiles according to the environment risk.

回避

Do not apply directly to production without a reviewed plan artifact and approval.
Do not assume sensitive variables keep secret values out of state.
Do not rename resource addresses blindly or use list indexes as durable identity.