iac-security-review

Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation). Use when reviewing IaC files for misconfigurations, overpermissioning, exposed resources, missing encryption, secrets in code, and supply chain risks. Covers CIS benchmarks and cloud security best practices.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-sequenced with concrete detection heuristics, but it leans on external files that are not included in the bundle and lacks validation checkpoints for a finding-producing review workflow. Adding a false-positive verification step and shipping the referenced bundle files would raise the weaker dimensions.

Suggestions

Add a validation step to the workflow (e.g., 'Confirm each finding is a true positive and not a false positive before reporting; re-check severity against the resource configuration') to provide a feedback loop for the finding-production process.

Ship the referenced bundle files (plays/iac-security-review.md, data/secure-code-prompts/terraform.md, kubernetes.md, cloudformation.md, templates/finding.md) so the inline references resolve to real content.

For the Produce Findings step, include a minimal concrete example of the expected finding format inline or ensure templates/finding.md exists and is clearly linked, so Claude has an executable template to follow.

Dimension	Reasoning	Score
Conciseness	Lean and efficient with no padding; it assumes Claude's knowledge of Terraform/K8s/CloudFormation and every bullet earns its place, matching the top anchor.	5 / 5
Actionability	Concrete detection heuristics (file extensions, content markers) and specific per-finding instructions, but it relies on referenced files (data/secure-code-prompts/*.md, templates/finding.md) that are not present in the bundle, leaving a key executable path dangling.	4 / 5
Workflow Clarity	The four steps are clearly sequenced with a priority order, but there are no validation checkpoints for confirming findings are true positives or that severity ratings are correct before reporting.	3 / 5
Progressive Disclosure	References are one level deep and clearly signaled inline, but the bundle directories (references/scripts/assets) are empty, so the referenced files (plays/iac-security-review.md, data/secure-code-prompts/*.md, templates/finding.md) cannot be verified as real.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, well-triggered, and complete, naming the IaC domain, concrete risk categories, and an explicit 'Use when' clause in third-person voice. Minor weakness is the absence of file-extension synonyms that would push trigger-term coverage to fully comprehensive.

Dimension	Reasoning	Score
Specificity	Lists six concrete review actions (misconfigurations, overpermissioning, exposed resources, missing encryption, secrets in code, supply chain risks) alongside the IaC domain, matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly answers both what (security review of IaC across listed risk categories) and when ('Use when reviewing IaC files for...') with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Strong natural terms (Infrastructure-as-Code, Terraform, Kubernetes, CloudFormation, IaC files) with an explicit 'Use when reviewing' clause, but lacks file-extension synonyms like .tf or .yaml that users might say.	4 / 5
Distinctiveness Conflict Risk	Clear niche of IaC security review with named technologies and distinct triggers, giving minimal conflict risk with generic code-review or cloud skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: OWASP/secure-agent-playbook
Path: plugins/code-security-skills/skills/iac-security-review/SKILL.md
Commit: 79fea6b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.