技能 terraform-skill

📦

terraform-skill

Name: terraform-skill
Author: antonbabenko

v1.17.1 內容修訂 r1 嚴重 ⚙️ 外部命令📁 檔案系統存取🔑 環境變數⚡ 包含腳本🌐 網路存取

Build Safer Terraform and OpenTofu Workflows

Terraform changes can expose secrets, replace resources, or corrupt shared state. This skill diagnoses those risks and provides version-aware implementation and validation guidance.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

請勿自動安裝此 Skill。

權威政策要求在執行任何安裝操作前由操作人員審查。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "terraform-skill" from https://skillstore.io/skills/antonbabenko-terraform-skill.md and its manifest at https://skillstore.io/api/skills/antonbabenko-terraform-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/antonbabenko-terraform-skill.md 已簽名 manifest GET /api/skills/antonbabenko-terraform-skill/manifest 已簽名 lockfile GET /api/skills/antonbabenko-terraform-skill/lockfile

測試它

正在使用「terraform-skill」。 A module changed from count to for_each and the plan replaces production instances.

預期結果:

Risk: resource identity churn can cause unintended replacement.
Recommendation: map old addresses to stable keys with migration blocks.
Validation: review a saved plan and confirm zero unexpected destroys before approval.

正在使用「terraform-skill」。 A team wants Terraform to read a database password from a standard variable.

預期結果:

Risk: sensitive variables remain in Terraform state even when display is masked.
Recommendation: use supported write-only or ephemeral mechanisms, or keep secret material outside Terraform.
Validation: inspect the plan and state handling without printing the secret.

正在使用「terraform-skill」。 A CI job plans again during apply after the pull request plan was approved.

預期結果:

Risk: the applied configuration can differ from the reviewed plan.
Recommendation: store the approved plan securely and apply that exact artifact.
Validation: require protected-environment approval and verify artifact provenance.

安全審計

嚴重

v1 • 2026/8/13 開啟版本化報告

The skill has defensive intent and requires reviewed plans, confirmation for destroy operations, and state-secret safeguards. Most static matches are Markdown syntax, Terraform identifiers, placeholders, or labeled examples rather than executable threats. Confirmed risks are an unverified pipe-to-shell installer, its mutable source URL, fragile xargs deletion, an unpinned action, and direct auto-approved apply examples.

已掃描檔案

6,669

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (3)

嚴重

references/security-compliance.md:43

Pipe to shell pattern

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

The installation example pipes a mutable remote script directly into sh without checksum or signature verification. A compromised upstream response would gain immediate code execution.

高

references/security-compliance.md:46

Unpinned GitHub Action

The Trivy CI example uses aquasecurity/trivy-action@master. A mutable branch reference can change without review and execute compromised action code with workflow permissions.

The source directly uses the mutable master ref, while another reference file demonstrates a pinned Trivy action version.

高

references/state-management.md:583 references/state-management.md:606 references/state-management.md:615

Direct Auto-Approved Infrastructure Apply

State-locking examples run terraform apply -auto-approve without applying a reviewed saved plan. Reusing this guidance can bypass change review and mutate infrastructure unexpectedly.

Three operational examples invoke direct auto-approved applies, contrary to the core requirement to apply a reviewed plan artifact.

能力複核項目 (2)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

references/security-compliance.md:43

Hardcoded URL

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b

This URL supplies the script executed by the pipe-to-shell command on the same line. It references a mutable branch path and provides no integrity verification.

中

references/state-management.md:1184

xargs command (can execute arbitrary commands)

ls -t $BACKUP_DIR/terraform.tfstate.* | tail -n +31 | xargs rm -f

The backup cleanup pipes parsed ls output into xargs rm and leaves BACKUP_DIR unquoted. Spaces or crafted filenames can split arguments and remove unintended files.

風險因素

⚙️ 外部命令 (50)

📁 檔案系統存取 (28)

🔑 環境變數 (20)

⚡ 包含腳本 (2)

references/code-patterns.md:401 references/testing-frameworks.md:394-399

🌐 網路存取 (19)

偵測到的模式

Pipe to shell pattern

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg)](https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/antonbabenko-terraform-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antonbabenko-terraform-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/antonbabenko-terraform-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

antonbabenko. (2026). terraform-skill security audit report (audit version 1) [Author version 1.17.1]. Skillstore. https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1

BibTeX 引用

@techreport{antonbabenko-antonbabenko-terraform-skill-2026,
  author = {antonbabenko},
  title = {terraform-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1},
  note = {Author version 1.17.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "terraform-skill security audit report (audit version 1)"
version: "1.17.1"
type: report
authors:
  - name: "antonbabenko"
date-released: "2026-08-13"
url: "https://skillstore.io/skills/antonbabenko-terraform-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:antonbabenko-terraform-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

比較變體

2 個可安裝變體

每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。

為何此變體排名第一

Skillstore 評分最高

作者 / 來源 Skillstore 評分證據置信度 Skillstore 使用量已更新

Anton Babenko 推薦

sickn33-terraform-skill

Skillstore 評分 80

證據置信度高

Skillstore 使用量 23

已更新

2026-09-09

antonbabenko 目前

antonbabenko-terraform-skill

Skillstore 評分 38

證據置信度低

Skillstore 使用量 11

已更新

2026-10-24

Skillstore 評分

評分依據證據置信度: 低

架構

100

可維護性

內容

社群

規範符合度

你可以打造什麼

Refactor a Shared Module

Plan address-preserving changes, add migration blocks, and validate that production resources are not replaced.

Build a Controlled Delivery Pipeline

Create validation, testing, policy, plan, approval, and exact-plan apply stages for infrastructure changes.

Recover and Harden Remote State

Investigate locks or drift, select a recovery path, and document backup and rollback evidence.

試試這些提示

Review a Terraform Configuration

Review this Terraform configuration for correctness and safety. State runtime assumptions, identify risks, propose focused changes, and provide validation steps.

Design a Reusable Module

Design a reusable [provider] module for [service]. Target [Terraform or OpenTofu version]. Include typed inputs, stable outputs, tests, security controls, and usage guidance.

Create an Infrastructure Pipeline

Design a CI/CD workflow for this repository. Separate validation, testing, security, plan, approval, and apply stages. Apply only the reviewed plan artifact.

Plan a State Recovery

Diagnose this [lock, drift, migration, or corruption] incident. Use the supplied backend details and logs to create evidence-preserving recovery and rollback procedures.

最佳實務

Provide the runtime, exact version, providers, backend, execution path, and environment criticality.
Review saved plans and retain rollback evidence before destructive or state-mutating operations.
Pin runtimes, providers, modules, actions, and lockfiles according to the environment risk.

避免

Do not apply directly to production without a reviewed plan artifact and approval.
Do not assume sensitive variables keep secret values out of state.
Do not rename resource addresses blindly or use list indexes as durable identity.