auditing-terraform-infrastructure-for-security

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

1.01x

Quality

71%

Does it follow best practices?

Impact

91%

1.01x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/auditing-terraform-infrastructure-for-security/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with comprehensive executable examples and a clear six-step workflow, but it is padded with redundant concept explanations and fails to link the existing bundle files, leaving reference content inlined.

Suggestions

Link the bundle files explicitly (e.g. 'See references/api-reference.md for the full CLI/API reference' and 'See scripts/agent.py for a runnable scan orchestrator') and move the duplicated CLI examples out of the body.

Trim or remove the 'Key Concepts' and 'Tools & Systems' sections that re-explain concepts Claude already knows, keeping only security-specific framing not obvious from the tool names.

Add an explicit validation/triage checkpoint to the main workflow (e.g. after scanning: verify non-zero exit codes, triage CRITICAL/HIGH, suppress accepted risks with justification).

Dimension	Reasoning	Score
Conciseness	Mostly efficient with extensive executable code, but the 'Key Concepts' and 'Tools & Systems' sections re-explain notions Claude already knows (IaC, OPA/Rego) and the inlined CLI examples duplicate content already present in references/api-reference.md.	3 / 5
Actionability	Fully executable, copy-paste-ready Checkov/tfsec/Terrascan commands, complete Rego policies, a full GitHub Actions pipeline, and concrete state-scanning snippets cover the common cases.	5 / 5
Workflow Clarity	Six clearly sequenced steps each with concrete commands, but the main workflow lacks explicit validation/triage checkpoints (verify scans succeeded, triage by severity); the only triage loop appears in the Common Scenarios pitfall rather than the workflow itself.	4 / 5
Progressive Disclosure	The body has good section structure, but the bundle files references/api-reference.md and scripts/agent.py are never referenced or signaled in the body, and reference-type CLI content that belongs in the separate file is inlined instead of linked.	3 / 5
	Total	15 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and tool-rich with good trigger terms, but it omits an explicit 'Use when…' trigger clause, which caps completeness. It is clearly niche with only minor overlap risk.

Suggestions

Append an explicit trigger clause, e.g. 'Use when reviewing Terraform code or CI/CD pipelines for security misconfigurations before cloud deployment.'

Add natural synonyms/file extensions users might say, such as '.tf files', 'scan Terraform', or 'terraform security audit'.

Sharpen distinctiveness by contrasting with runtime CSPM/SAST tools in a single phrase.

Dimension	Reasoning	Score
Specificity	Names the domain (Terraform IaC security) and lists multiple concrete detection actions — 'overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults' — plus four named tools, giving comprehensive coverage.	5 / 5
Completeness	Has a clear 'what' (auditing Terraform IaC for security misconfigurations with named tools) but no 'Use when…' clause or equivalent explicit trigger guidance, so completeness is capped at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Strong natural keywords users would say (Terraform, infrastructure-as-code, Checkov, tfsec, IAM policies) but missing common synonyms and file extensions like '.tf' or 'scan terraform'.	4 / 5
Distinctiveness Conflict Risk	Terraform-specific IaC auditing with named tools is a clear niche, but it has minor overlap risk with broader cloud-security/CSPM skills; not a 5 because it does not sharply separate itself from adjacent cloud-security skills.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/auditing-terraform-infrastructure-for-security/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.