iac-security

Infrastructure as Code security scanning for Terraform, Kubernetes, CloudFormation, and Azure ARM. Detects misconfigurations, security risks, and compliance violations before deployment. Use when: - User asks to scan Terraform files or modules - User mentions "infrastructure security" or "IaC scan" - User is working with Kubernetes manifests - User asks about CloudFormation or ARM template security - Agent is generating or modifying infrastructure code

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable code and a well-sequenced, validated workflow. Its main weakness is organization: extensive remediation code is inlined that duplicates the two unreferenced bundle files, which both pads the document and leaves the references unused.

Suggestions

Replace the inline Terraform and Kubernetes remediation code in Phase 4 with brief pointers to references/terraform-security-patterns.md and references/kubernetes-security-patterns.md, keeping only one representative example per platform in SKILL.md.

Remove the 'Quick Start' block or fold it into Phase 1, since it restates the same discovery→scan→analyze→remediate steps the phases already cover.

Add a short 'References' section that explicitly links the two bundle files so the progressive-disclosure structure is clear and navigable.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient and actionable, but the inline remediation code (Terraform/Kubernetes/CloudFormation fixes) duplicates the existing reference bundle files, and the 'Quick Start' block repeats what the Phase sections already cover, so it could be tightened.	2 / 3
Actionability	Provides fully executable commands and copy-paste-ready code throughout — 'terraform plan -out=tfplan', 'terraform show -json tfplan', concrete snyk_iac_scan invocations with parameters, and complete HCL/YAML remediation snippets.	3 / 3
Workflow Clarity	A clearly sequenced five-phase workflow (Discovery → Execute → Analyze → Remediation → Verification) with an explicit validation feedback loop in Phase 5 ('Re-scan After Changes' with before/after reporting) and an error-handling table for recovery.	3 / 3
Progressive Disclosure	Two reference files exist (terraform-security-patterns.md, kubernetes-security-patterns.md) but the body never signals or links them, while the detailed remediation code that belongs in those references is kept inline — content that should be separate is inline and references are not surfaced.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete actions, platforms, and detection types, with an explicit and thorough 'Use when' trigger list. It clearly answers both what the skill does and when to invoke it without padding or over-claims.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions — scanning across 'Terraform, Kubernetes, CloudFormation, and Azure ARM' and 'Detects misconfigurations, security risks, and compliance violations' — rather than vague language.	3 / 3
Completeness	Explicitly answers both what ('security scanning ... Detects misconfigurations, security risks, and compliance violations before deployment') and when (an explicit 'Use when:' clause with five triggers), matching the level-3 anchor.	3 / 3
Trigger Term Quality	The 'Use when' block covers natural phrasings a user would say ('scan Terraform files', 'IaC scan', 'infrastructure security', 'Kubernetes manifests', 'CloudFormation or ARM template security'), giving good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	The niche is narrow and distinct — IaC security scanning tied to named platforms — and the triggers are specific enough that it is unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: snyk/studio-recipes
Path: command_directives/synchronous_remediation/skills/iac-security/SKILL.md
Commit: 80e11c7

Reviewed: about 8 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.