# Tf Copilot

> Terraform plan triager with compliance-aware fix suggestions.

- Skill: `sahit-sai/tf-copilot` (Agent Skill, multi-file: 8 files)
- Install (CLI): `npx skillmds@latest add sahit-sai/tf-copilot`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sahit-sai/tf-copilot/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: sahit-sai (https://skillmd.com/u/sahit-sai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sahit-sai/tf-copilot

---


# tf-copilot

## Purpose

Terraform plan triager with compliance-aware fix suggestions.

## Runbook

1. Run `scripts/plan.sh [PLAN_FILE]` — if no `PLAN_FILE` is given, it runs `terraform plan -out=tf.plan && terraform show -json tf.plan` in the current directory and writes the JSON output to `tf-plan.json`.
2. Parse the plan JSON to extract resources to add, change, destroy, plus provider version constraints.
3. If the plan contains a destroy count greater than `0`, emit a prominent warning and list affected resource addresses.
4. Run `scripts/lint.sh` to invoke `checkov` and `tfsec` when they are available; collect the normalized findings into `tf-findings.json`.
5. Produce a markdown report via `scripts/report.sh` summarizing the plan diff table, compliance findings (HIGH / MEDIUM / LOW counts), and recommended fixes.
6. Never apply the plan — this skill is read-only analysis only.

## Stop conditions

1. Abort if `terraform` is missing.
2. Abort if the working directory has no `.tf` files and no `PLAN_FILE` is given.
3. Abort if a plan contains more than 10 destroys without an explicit `--allow-destroy` flag to `plan.sh`.
4. Abort if `aws` CLI credentials are not configured when the plan targets AWS resources.

## Output format

- `tf-plan.json` — raw `terraform show -json` output
- `tf-findings.json` — normalized `checkov` / `tfsec` findings
- Console: markdown report with a plan diff table and fix suggestions

## Example invocations

- `bash skills/tf-copilot/scripts/plan.sh`
- `bash skills/tf-copilot/scripts/plan.sh my-saved.plan.json`
- `bash skills/tf-copilot/scripts/lint.sh`
- `bash skills/tf-copilot/scripts/report.sh tf-plan.json tf-findings.json`
- "Analyze my terraform plan and tell me what will be destroyed."