How do I install the Iac Scan skill?

Run npx skillmds@latest add aibot88/iac-scan in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Iac Scan safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Iac Scan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Iac Scan free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Iac Scan?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Iac Scan by aibot88 — Agent Skill

Name: Iac Scan
Rating: 4.2 (5 reviews)
Author: aibot88

Iac Scan

Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration.

aibot88 Updated Sep 9, 2026 3 repo stars

File contents

Vulnetix IaC Scan Skill

Use when

Pre-apply: scan *.tf / *.tofu for misconfigurations.
PR review: catch open security groups, plaintext secrets, IAM wildcards.
Audit existing infra against compliance baselines (CIS, NIST).
Detect drift between repo IaC and deployed state.
Pre-merge: gate on critical findings (e.g. publicly-readable S3).

Don't use for

Source-code SAST — use /vulnetix:sast-scan.
Dockerfile / container analysis — use /vulnetix:container-scan.
Cloud runtime monitoring — Pix is static-only; use a CSPM for runtime.

Conventions

This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.

Step 1: Load capabilities

Read .vulnetix/capabilities.yaml. Confirm derived.has_iac: true or --paths provided. Otherwise abort.

Step 2: Run scan

vulnetix iac --paths "$PATHS" -o json > .vulnetix/iac.${TIMESTAMP}.json

Captures: open security groups, missing encryption, public S3/GCS, IAM wildcards, unpinned providers, secrets in plaintext, missing tags, unencrypted state backends.

Step 3: Render

Group by file. For each high-severity issue, include a 2-3 line code example of the fix.

Step 4: Risk overlay

If binaries.terraform: true (or tofu), suggest:

terraform plan -no-color | head -200    # for context on what would change

Don't run terraform apply from the skill.

Memory update

.vulnetix/iac/<timestamp>.summary.yaml with finding counts.

Edge cases & gotchas

Requires derived.has_iac: true OR explicit --paths. CWD without *.tf files = empty result.
Detection is static — it cannot evaluate runtime variable interpolation. var.environment == "prod" conditional logic is reported as both branches.
terraform plan integration is suggestive only — the skill does NOT run terraform plan automatically (state access concerns).
Provider-specific rules (AWS / GCP / Azure) are detected via resource type prefixes; modules wrapping resources may obscure the type.
Pre-existing infra not present in IaC (terraform import candidates) is not detected.
k8s manifest support is limited to top-level YAML in *.yaml files with kind: matching common workload types.

---name: iac-scandescription: Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration.--- # Vulnetix IaC Scan Skill ## Use when - Pre-apply: scan `*.tf` / `*.tofu` for misconfigurations. - PR review: catch open security groups, plaintext secrets, IAM wildcards. - Audit existing infra against compliance baselines (CIS, NIST). - Detect drift between repo IaC and deployed state. - Pre-merge: gate on critical findings (e.g. publicly-readable S3). ## Don't use for - Source-code SAST — use `/vulnetix:sast-scan`. - Dockerfile / container analysis — use `/vulnetix:container-scan`. - Cloud runtime monitoring — Pix is static-only; use a CSPM for runtime. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Confirm `derived.has_iac: true` or `--paths` provided. Otherwise abort. ## Step 2: Run scan ```bash vulnetix iac --paths "$PATHS" -o json > .vulnetix/iac.${TIMESTAMP}.json ``` Captures: open security groups, missing encryption, public S3/GCS, IAM wildcards, unpinned providers, secrets in plaintext, missing tags, unencrypted state backends. ## Step 3: Render | Severity | File:Line | Resource | Issue | Recommendation | Group by file. For each high-severity issue, include a 2-3 line code example of the fix. ## Step 4: Risk overlay If `binaries.terraform: true` (or `tofu`), suggest: ```bash terraform plan -no-color | head -200 # for context on what would change ``` Don't run `terraform apply` from the skill. ## Memory update `.vulnetix/iac/<timestamp>.summary.yaml` with finding counts. ## Edge cases & gotchas - Requires `derived.has_iac: true` OR explicit `--paths`. CWD without `*.tf` files = empty result. - Detection is static — it cannot evaluate runtime variable interpolation. `var.environment == "prod"` conditional logic is reported as both branches. - `terraform plan` integration is suggestive only — the skill does NOT run `terraform plan` automatically (state access concerns). - Provider-specific rules (AWS / GCP / Azure) are detected via resource type prefixes; modules wrapping resources may obscure the type. - Pre-existing infra not present in IaC (`terraform import` candidates) is not detected. - k8s manifest support is limited to top-level YAML in `*.yaml` files with kind: matching common workload types.

Frequently asked questions