# Terraform Plan Risk Auditor

> Analyze Terraform plan JSON for risky changes and blast radius.

- Skill: `xspoonai/terraform-plan-risk-auditor` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add xspoonai/terraform-plan-risk-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/xspoonai/terraform-plan-risk-auditor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: XSpoonAi (https://skillmd.com/u/xspoonai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/xspoonai/terraform-plan-risk-auditor

---


## Description

Analyze Terraform plan JSON (from `terraform show -json plan.out`) for risky changes like destroys, replaces, IAM changes, and potential public exposure.

## Inputs

```json
{
  "plan_json": {"resource_changes": []},
  "plan_json_text": "{...}",
  "plan_path": "path/to/plan.json",
  "max_findings": 50,
  "focus": "security|cost|all"
}
```

Notes:
- Provide exactly one of `plan_json`, `plan_json_text`, or `plan_path`.
- `focus` filters findings (`security`, `cost`, or `all`).

## Outputs

Success:
```json
{
  "ok": true,
  "data": {
    "demo": false,
    "summary": {"create": 0, "update": 0, "delete": 0, "replace": 0, "total_changes": 0},
    "risk_score": 0,
    "risk_level": "LOW|MEDIUM|HIGH|CRITICAL",
    "findings": [],
    "top_resources": []
  }
}
```

Error:
```json
{
  "ok": false,
  "error": "...",
  "details": {"message": "..."}
}
```

## Usage

Demo mode:
```bash
python3 scripts/main.py --demo
```

With parameters:
```bash
python3 scripts/main.py --params '{"plan_path": "./plan.json"}'
```

Via stdin:
```bash
echo '{"plan_path": "./plan.json"}' | python3 scripts/main.py
```

## Examples

```bash
python3 scripts/main.py --params '{"plan_json": {"resource_changes": []}}'
```

## Error Handling

All errors return JSON with `ok:false` and exit with a non-zero code.