技能 terraform-skill

📦

terraform-skill

Name: terraform-skill
Author: antonbabenko

v1.17.1 内容修订 r1 严重 ⚙️ 外部命令📁 文件系统访问🔑 环境变量⚡ 包含脚本🌐 网络访问

Build Safer Terraform and OpenTofu Workflows

Terraform changes can expose secrets, replace resources, or corrupt shared state. This skill diagnoses those risks and provides version-aware implementation and validation guidance.

支持: Claude Codex Code(CC)

⚠️ 38 差

请勿自动安装此 Skill。

权威策略要求在执行任何安装操作前由操作人员审查。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "terraform-skill" from https://skillstore.io/skills/antonbabenko-terraform-skill.md and its manifest at https://skillstore.io/api/skills/antonbabenko-terraform-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/antonbabenko-terraform-skill.md 已签名 manifest GET /api/skills/antonbabenko-terraform-skill/manifest 已签名 lockfile GET /api/skills/antonbabenko-terraform-skill/lockfile

测试它

正在使用“terraform-skill”。 A module changed from count to for_each and the plan replaces production instances.

预期结果:

Risk: resource identity churn can cause unintended replacement.
Recommendation: map old addresses to stable keys with migration blocks.
Validation: review a saved plan and confirm zero unexpected destroys before approval.

正在使用“terraform-skill”。 A team wants Terraform to read a database password from a standard variable.

预期结果:

Risk: sensitive variables remain in Terraform state even when display is masked.
Recommendation: use supported write-only or ephemeral mechanisms, or keep secret material outside Terraform.
Validation: inspect the plan and state handling without printing the secret.

正在使用“terraform-skill”。 A CI job plans again during apply after the pull request plan was approved.

预期结果:

Risk: the applied configuration can differ from the reviewed plan.
Recommendation: store the approved plan securely and apply that exact artifact.
Validation: require protected-environment approval and verify artifact provenance.

安全审计

严重

v1 • 2026/8/13 打开版本化报告

The skill has defensive intent and requires reviewed plans, confirmation for destroy operations, and state-secret safeguards. Most static matches are Markdown syntax, Terraform identifiers, placeholders, or labeled examples rather than executable threats. Confirmed risks are an unverified pipe-to-shell installer, its mutable source URL, fragile xargs deletion, an unpinned action, and direct auto-approved apply examples.

已扫描文件

6,669

分析行数

复核项

已忽略误报

已确认安全问题 (3)

严重

references/security-compliance.md:43

Pipe to shell pattern

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

The installation example pipes a mutable remote script directly into sh without checksum or signature verification. A compromised upstream response would gain immediate code execution.

高

references/security-compliance.md:46

Unpinned GitHub Action

The Trivy CI example uses aquasecurity/trivy-action@master. A mutable branch reference can change without review and execute compromised action code with workflow permissions.

The source directly uses the mutable master ref, while another reference file demonstrates a pinned Trivy action version.

高

references/state-management.md:583 references/state-management.md:606 references/state-management.md:615

Direct Auto-Approved Infrastructure Apply

State-locking examples run terraform apply -auto-approve without applying a reviewed saved plan. Reusing this guidance can bypass change review and mutate infrastructure unexpectedly.

Three operational examples invoke direct auto-approved applies, contrary to the core requirement to apply a reviewed plan artifact.

能力复核项 (2)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

references/security-compliance.md:43

Hardcoded URL

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

This URL supplies the script executed by the pipe-to-shell command on the same line. It references a mutable branch path and provides no integrity verification.

中

references/state-management.md:1184

xargs command (can execute arbitrary commands)

ls -t $BACKUP_DIR/terraform.tfstate.* | tail -n +31 | xargs rm -f

The backup cleanup pipes parsed ls output into xargs rm and leaves BACKUP_DIR unquoted. Spaces or crafted filenames can split arguments and remove unintended files.

风险因素

⚙️ 外部命令 (50)

📁 文件系统访问 (28)

🔑 环境变量 (20)

⚡ 包含脚本 (2)

references/code-patterns.md:401 references/testing-frameworks.md:394-399

🌐 网络访问 (19)

检测到的模式

Pipe to shell pattern

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg)](https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/antonbabenko-terraform-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

antonbabenko. (2026). terraform-skill security audit report (audit version 1) [Author version 1.17.1]. Skillstore. https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1

BibTeX 引用

@techreport{antonbabenko-antonbabenko-terraform-skill-2026,
  author = {antonbabenko},
  title = {terraform-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1},
  note = {Author version 1.17.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "terraform-skill security audit report (audit version 1)"
version: "1.17.1"
type: report
authors:
  - name: "antonbabenko"
date-released: "2026-08-13"
url: "https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:antonbabenko-terraform-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

比较变体

2 个可安装变体

每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。

为什么此变体排名第一

Skillstore 评分最高

作者 / 来源 Skillstore 评分证据置信度 Skillstore 使用量已更新

Anton Babenko 推荐

sickn33-terraform-skill

Skillstore 评分 80

证据置信度高

Skillstore 使用量 20

已更新

2026-09-09

antonbabenko 当前

antonbabenko-terraform-skill

Skillstore 评分 38

证据置信度低

Skillstore 使用量 7

已更新

2026-09-09

Skillstore 评分

评分依据证据置信度: 低

架构

100

可维护性

内容

社区

规范符合性

你能构建什么

Refactor a Shared Module

Plan address-preserving changes, add migration blocks, and validate that production resources are not replaced.

Build a Controlled Delivery Pipeline

Create validation, testing, policy, plan, approval, and exact-plan apply stages for infrastructure changes.

Recover and Harden Remote State

Investigate locks or drift, select a recovery path, and document backup and rollback evidence.

试试这些提示

Review a Terraform Configuration

Review this Terraform configuration for correctness and safety. State runtime assumptions, identify risks, propose focused changes, and provide validation steps.

Design a Reusable Module

Design a reusable [provider] module for [service]. Target [Terraform or OpenTofu version]. Include typed inputs, stable outputs, tests, security controls, and usage guidance.

Create an Infrastructure Pipeline

Design a CI/CD workflow for this repository. Separate validation, testing, security, plan, approval, and apply stages. Apply only the reviewed plan artifact.

Plan a State Recovery

Diagnose this [lock, drift, migration, or corruption] incident. Use the supplied backend details and logs to create evidence-preserving recovery and rollback procedures.

最佳实践

Provide the runtime, exact version, providers, backend, execution path, and environment criticality.
Review saved plans and retain rollback evidence before destructive or state-mutating operations.
Pin runtimes, providers, modules, actions, and lockfiles according to the environment risk.

避免

Do not apply directly to production without a reviewed plan artifact and approval.
Do not assume sensitive variables keep secret values out of state.
Do not rename resource addresses blindly or use list indexes as durable identity.