Skills iac-checkov

📦

iac-checkov

Name: iac-checkov
Author: AgentSecOps

v0.1.0 Content revision r2 High Risk 🌐 Network access📁 Filesystem access🔑 Env variables⚙️ External commands

Scan Infrastructure Code with Checkov

Infrastructure teams need consistent security checks before deployment. This skill guides Checkov scans, policy customization, suppression governance, compliance mapping, and CI integration.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "iac-checkov" from https://skillstore.io/skills/agentsecops-iac-checkov.md and its manifest at https://skillstore.io/api/skills/agentsecops-iac-checkov/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-iac-checkov.md Signed manifest GET /api/skills/agentsecops-iac-checkov/manifest Signed lockfile GET /api/skills/agentsecops-iac-checkov/lockfile

Test it

Using "iac-checkov". Review a Terraform scan with one public storage bucket and three missing tag findings.

Expected outcome:

Priority: Treat the public bucket as urgent because it can expose data.
Remediation: Block public access and verify access policies before deployment.
Follow-up: Resolve tag findings through a shared module after the exposure is fixed.

Using "iac-checkov". Design a GitHub pull request gate for critical and high findings.

Expected outcome:

The gate blocks critical and high findings and publishes a SARIF report.
Scanner failures and missing reports fail the job.
Actions, packages, and container images use reviewed immutable versions.

Using "iac-checkov". Assess a request to suppress an encryption finding for a development database.

Expected outcome:

Decision: Require documented non-production scope and synthetic data.
Approval: Assign an owner, expiration date, and security reviewer.
Compensating control: Restrict network access and monitor database activity.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

Manual review dismissed 154 static alerts as documentation, fixed-path parsing, exclusions, placeholders, or safe command examples. One unpinned remote-policy example is confirmed, and semantic review found fail-open CI logic, mutable privileged dependencies, and weakened default enforcement. No prompt injection or data-exfiltration intent was found.

Files scanned

2,461

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

assets/github_actions.yml:146-168

Security Gate Can Pass When Checkov Fails

The GitHub security gate captures the Checkov exit code but never uses it. If no report is created, the file check is skipped and the step reports success.

The script assigns EXIT_CODE after Checkov, only evaluates findings when the report exists, and has no final nonzero exit. The success message is unconditional.

High

assets/github_actions.yml:21-35 assets/github_actions.yml:58-59 assets/github_actions.yml:81-82 assets/github_actions.yml:110-111 assets/gitlab_ci.yml:9-10

Mutable CI Dependencies Run With Write Permissions

The workflow grants write permissions globally and runs Checkov actions from the mutable master branch. It also installs unpinned packages and uses latest container tags.

The files explicitly use bridgecrewio/checkov-action@master, pip install without a version, and bridgecrew/checkov:latest. Global write permissions increase the impact of dependency compromise.

Medium

assets/checkov_config.yaml:11-38 assets/pre_commit_config.yaml:11-15

Default Templates Weaken Scan Enforcement

The main configuration globally skips several security checks, excludes tests and examples, and soft-fails lower severities. The default pre-commit scan also warns without blocking.

These settings are active defaults in templates intended for project use. They reduce coverage or enforcement unless adopters notice and override them.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/custom_policies.md:287

Hardcoded URL

checkov -d ./terraform --external-checks-git https://github.com/org/policies.git

The example loads external checks from a mutable Git repository without a pinned revision. A copied configuration could execute changed or untrusted policy code during a scan.

Risk Factors

🌐 Network access (25)

📁 Filesystem access (3)

assets/checkov_config.yaml:27 assets/github_actions.yml:176 assets/github_actions.yml:176

🔑 Env variables (1)

assets/checkov_config.yaml:74

⚙️ External commands (50)

assets/github_actions.yml:183-192 assets/github_actions.yml:156 assets/github_actions.yml:157 assets/gitlab_ci.yml:111 assets/gitlab_ci.yml:142 assets/gitlab_ci.yml:143 assets/gitlab_ci.yml:187 references/suppression_guide.md:133 SKILL.md:39-48 SKILL.md:48-52 SKILL.md:52-61 SKILL.md:61-65 SKILL.md:65-71 SKILL.md:71-75 SKILL.md:75-78 SKILL.md:78-86 SKILL.md:86-93 SKILL.md:93-105 SKILL.md:105-117 SKILL.md:117-131 SKILL.md:131-144 SKILL.md:144-156 SKILL.md:156-163 SKILL.md:163-165 SKILL.md:165-178 SKILL.md:178-180 SKILL.md:180-186 SKILL.md:186-207 SKILL.md:207-211 SKILL.md:211-213 SKILL.md:213-215 SKILL.md:215-221 SKILL.md:221-234 SKILL.md:234-243 SKILL.md:243-251 SKILL.md:251-276 SKILL.md:276-282 SKILL.md:282-291 SKILL.md:291-295 SKILL.md:295-298 SKILL.md:298-302 SKILL.md:302-316 SKILL.md:316-320 SKILL.md:320-342 SKILL.md:342-344 SKILL.md:344-352 SKILL.md:352-361 SKILL.md:361-374 SKILL.md:374-383 SKILL.md:383-398

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentsecops-iac-checkov/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-iac-checkov/security.svg)](https://skillstore.io/skills/agentsecops-iac-checkov?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-iac-checkov?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-iac-checkov/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-iac-checkov.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). iac-checkov security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-iac-checkov/audits/9

BibTeX citation

@techreport{agentsecops-agentsecops-iac-checkov-2026,
  author = {AgentSecOps},
  title = {iac-checkov security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/agentsecops-iac-checkov/audits/9},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "iac-checkov security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
  - name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-iac-checkov/audits/9"
identifiers:
  - type: other
    value: "skillstore:agentsecops-iac-checkov:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add Pre-Merge IaC Scanning

Create consistent Checkov checks for pull requests and publish readable security results.

Govern Policies and Exceptions

Develop custom checks, test policy behavior, and manage justified suppressions with expiration dates.

Prepare Compliance Evidence

Relate scan findings to selected frameworks and organize reports for control review.

Try These Prompts

Run a First Scan

Scan my [IaC path] with Checkov for [framework]. Explain installation, command selection, and how to prioritize the results.

Triage Findings

Review these Checkov findings: [paste output]. Group them by severity, identify likely false positives, and propose concrete remediation steps.

Build a CI Gate

Design a Checkov CI gate for [platform] that blocks [severities], publishes [formats], preserves artifacts, and fails when reports are missing.

Design Policy Governance

Create a governed Checkov policy program for [organization]. Include custom policy structure, tests, suppression approvals, dependency pinning, baselines, and compliance reporting.

Best Practices

Pin Checkov, CI actions, container images, and external policy sources to reviewed immutable versions.
Treat missing reports and scanner errors as gate failures.
Document every suppression with an owner, reason, expiration date, and compensating controls.

Avoid

Do not use blanket suppressions or soft-fail settings for production gates.
Do not load unreviewed external Python policies or mutable CI dependencies.
Do not treat Checkov output as compliance certification without validating controls.