terraform-state-leak

Exploit exposed Terraform state files — secrets, cloud creds, RDS passwords, IAM keys, and infrastructure topology in plain JSON.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/cloud/terraform-state-leak/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands and a clear numbered workflow, but earns 2s on conciseness, workflow clarity, and progressive disclosure due to conceptual framing, missing validation on destructive pivots, and a monolithic structure with no reference files.

Suggestions

Trim the opening conceptual framing and the 'Known exemplars' section, which restate context Claude already knows or supplementary history, to tighten token efficiency toward level 3.

Add explicit validation/verification checkpoints for the destructive pivots — e.g. confirm key permissions with 'aws iam list-attached-user-policies' before launching EC2, and verify RDS reachability before connecting — to lift workflow clarity above 2.

Move the 'Defender remediation', 'CVSS', and 'Known exemplars' sections into a reference file (e.g. references/remediation.md) and link to it from the body, so the main SKILL.md stays an overview and progressive disclosure improves.

Dimension	Reasoning	Score
Conciseness	The body is dense and operational (mostly tight curl/aws/jq/gh/git commands), but the opening framing ('Terraform's terraform.tfstate file is a plaintext JSON map of every resource Terraform manages') explains a concept Claude already knows, and the 'Known exemplars' history section is supplementary rather than core, so it does not fully reach the lean level-3 anchor.	2 / 3
Actionability	It is dominated by fully executable, copy-paste-ready commands and specific jq queries (e.g. the IAM-key, RDS-password, and connection-URL extractors), matching the level-3 anchor; only the 'Promote' section's 'for each cred:' is mildly pseudocode-like, which does not undercut the overall executability.	3 / 3
Workflow Clarity	A clear numbered sequence (Discover → Parse → Topology → Validate → RDS pivot → Promote) with one explicit validation checkpoint (Section 4: 'aws sts get-caller-identity ... if valid → confirmed live cred'), but the destructive pivots (RDS connect, EC2 launch via stolen keys) and the Promote step lack validation/feedback loops, so per the destructive-operations guideline workflow clarity is capped at 2.	2 / 3
Progressive Disclosure	The body is well organized into clear sections but is a single monolithic ~190-line file with no bundle references (none exist), and content that could be split out (Defender remediation, CVSS, Known exemplars) is inline, fitting the level-2 anchor rather than the one-level-deep-reference level-3 anchor.	2 / 3
	Total	9 / 12 Passed

Description

57%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete and occupies a clear, distinctive niche, but it stops at level 2 on specificity, trigger-term coverage, and completeness because it uses one action verb, omits natural .tfstate variations, and lacks an explicit 'Use when' trigger clause.

Suggestions

Add an explicit trigger clause, e.g. 'Use when assessing exposed or leaked Terraform state files, or when .tfstate / tfstate.backup files surface in public S3, web roots, or git history.' to lift completeness to 3.

Include natural keyword variations a user would say — '.tfstate', 'tfstate.backup', 'terraform state leak' — directly in the description to improve trigger-term coverage.

Replace the single verb 'Exploit' with multiple concrete actions, e.g. 'Discover, parse, and extract secrets from exposed Terraform state files', to raise specificity.

Dimension	Reasoning	Score
Specificity	The phrase 'Exploit exposed Terraform state files' names the domain and a concrete action, and enumerates specific contents ('secrets, cloud creds, RDS passwords, IAM keys, and infrastructure topology'), but it relies on a single action verb rather than listing multiple concrete actions as the level-3 anchor requires.	2 / 3
Completeness	It clearly answers 'what' (exploit exposed state files for secrets), but there is no explicit 'Use when...' clause or equivalent trigger guidance in the description, which per the judging guidelines caps completeness at 2.	2 / 3
Trigger Term Quality	'Terraform state files' plus secret-type terms are natural for the audience, but common variations a user would actually say — '.tfstate', 'tfstate.backup', 'terraform state leak' — are absent from the description (they appear only in metadata.when_to_use).	2 / 3
Distinctiveness Conflict Risk	The 'Terraform state files' niche with concrete secret types (RDS passwords, IAM keys, topology) is highly distinct and unlikely to trigger for sibling skills; the sole cross-reference is to a clearly different skill (aws-iam-enum).	3 / 3
	Total	9 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/cloud/terraform-state-leak/SKILL.md
Commit: e34afba

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.