auditing-terraform-infrastructure-for-security

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

1.01x

Quality

62%

Does it follow best practices?

Impact

91%

1.01x

Average score across 3 eval scenarios

Securityby

Passed

No known issues

Fix and improve this skill with Tessl

tessl review fix ./skills/auditing-terraform-infrastructure-for-security/SKILL.md

Quality

Content

42%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is highly actionable with excellent executable examples covering multiple tools, real Rego policies, and a complete CI/CD pipeline. However, it is excessively verbose, explaining concepts Claude already knows (IaC definitions, shift-left security), and dumps everything into a single monolithic file without progressive disclosure. The workflow lacks explicit validation checkpoints and error recovery feedback loops between scanning steps.

Suggestions

Remove the 'Key Concepts' table entirely—Claude knows what IaC, shift-left security, and Terraform plans are. Remove the 'Tools & Systems' section as it repeats what's already demonstrated in the workflow.

Add explicit validation checkpoints between steps, e.g., 'Review Checkov output for CRITICAL findings before proceeding to tfsec' and 'If any scanner reports CRITICAL findings, stop and remediate before CI/CD integration.'

Split OPA policy examples, CI/CD pipeline YAML, and the output format template into separate referenced files (e.g., policies/examples.rego, ci/github-actions.yml, templates/report-format.md) to reduce the main file to an overview with clear navigation.

Trim redundant command variations—showing 7 Checkov invocations and 7 tfsec invocations is excessive. Keep 2-3 most common patterns per tool and reference a cheatsheet file for the rest.

Dimension	Reasoning	Score
Conciseness	Extremely verbose at ~250+ lines. The 'Key Concepts' table explains things Claude already knows (what IaC is, what 'shift left' means, what a Terraform plan is). The 'Tools & Systems' section repeats information already demonstrated in the workflow. The 'When to Use' and 'Do not use' sections are unnecessarily detailed. Many command variations are shown that could be trimmed significantly.	1 / 3
Actionability	Provides fully executable bash commands, complete Rego policy files, a working GitHub Actions YAML pipeline, and concrete CLI invocations with real flags and options. All code is copy-paste ready with real tool names, check IDs, and output formats.	3 / 3
Workflow Clarity	Steps are clearly sequenced (scan with Checkov → tfsec → Terrascan → custom OPA → CI/CD → state audit), but there are no explicit validation checkpoints or feedback loops between steps. There's no guidance on what to do when a scan fails mid-workflow, no 'verify results before proceeding' gates, and no error recovery steps between the scanning phases.	2 / 3
Progressive Disclosure	Monolithic wall of content with no references to external files. Everything is inline—the OPA policies, the CI/CD pipeline, the output format template, the common scenarios—all of which could be split into separate referenced files. No bundle files exist to support progressive disclosure, and the skill makes no attempt to organize content across files.	1 / 3
	Total	7 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong description with excellent specificity, naming concrete tools (Checkov, tfsec, Terrascan, OPA/Rego) and specific security issues to detect (IAM, encryption, public exposure). Its main weakness is the lack of an explicit 'Use when...' clause, which would help Claude know precisely when to select this skill. The domain-specific terminology provides excellent trigger term coverage for users working with Terraform security.

Suggestions

Add an explicit 'Use when...' clause, e.g., 'Use when the user asks to scan, audit, or review Terraform code for security issues, compliance checks, or misconfigurations before deployment.'

Consider adding file extension triggers like '.tf', '.tfvars', or 'HCL' to capture additional natural user references to Terraform files.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: auditing Terraform IaC, detecting overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults. Also names specific tools: Checkov, tfsec, Terrascan, and OPA/Rego policies.	3 / 3
Completeness	The 'what' is thoroughly covered with specific tools and detection targets, but there is no explicit 'Use when...' clause or equivalent trigger guidance. The phrase 'before cloud deployment' hints at timing but doesn't constitute an explicit 'when to use' directive. Per rubric guidelines, missing 'Use when...' caps completeness at 2.	2 / 3
Trigger Term Quality	Excellent coverage of natural terms users would say: 'Terraform', 'security', 'Checkov', 'tfsec', 'Terrascan', 'OPA', 'Rego', 'IAM policies', 'encryption', 'cloud deployment', 'infrastructure-as-code'. These are terms a user working in this domain would naturally use.	3 / 3
Distinctiveness Conflict Risk	Highly distinctive with a clear niche: Terraform-specific security auditing using named static analysis tools. The combination of Terraform + specific security scanning tools + specific vulnerability categories makes it very unlikely to conflict with other skills.	3 / 3
	Total	11 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Commit: 7eebca8

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.