iac-security

Infrastructure as Code security scanning for Terraform, Kubernetes, CloudFormation, and Azure ARM. Detects misconfigurations, security risks, and compliance violations before deployment. Use when: - User asks to scan Terraform files or modules - User mentions "infrastructure security" or "IaC scan" - User is working with Kubernetes manifests - User asks about CloudFormation or ARM template security - Agent is generating or modifying infrastructure code

Quality

—

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Passed

No known issues

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable with a clear, well-validated multi-phase workflow and executable examples. Weaker on conciseness and progressive disclosure: the inline remediation blocks are lengthy and the existing reference files are never linked from the body.

Suggestions

Link the existing references from the body, e.g. in Phase 4 add 'See [terraform-security-patterns.md](references/terraform-security-patterns.md)' and the Kubernetes equivalent, so the bundle files are no longer orphaned.

Move the bulk of the inline Terraform/Kubernetes/CloudFormation remediation code into those reference files, keeping only one representative example per platform in SKILL.md to tighten the body.

Collapse the Quick Start block into a pointer to Phase 1–5 to remove the restated sequence and reduce redundancy.

Dimension	Reasoning	Score
Conciseness	Mostly lean and task-oriented with tables/code instead of concept explanation, but ~360 lines with redundancy: Quick Start restates the phases and large inline remediation blocks (Terraform/K8s/CloudFormation) duplicate content the reference files already cover.	2 / 3
Actionability	Concrete snyk_iac_scan invocations with named parameters, executable terraform plan/show commands, and complete copy-paste HCL/YAML remediation examples — fully executable and specific.	3 / 3
Workflow Clarity	A clear 5-phase sequence (Discovery → Execute → Analyze → Remediation → Verification) with an explicit re-scan feedback loop, before/after comparison, and an error-handling table providing checkpoints for risky IaC operations.	3 / 3
Progressive Disclosure	Two reference files exist (terraform/kubernetes security patterns) but the body never references or signals them, leaving them orphaned, while large fix examples remain inline that belong in those references.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states what the skill does and when to use it via explicit triggers. It avoids fluff and names concrete platforms and actions.

Dimension	Reasoning	Score
Specificity	Lists concrete actions ('Detects misconfigurations, security risks, and compliance violations') across four named IaC platforms, matching the 'multiple specific concrete actions' anchor.	3 / 3
Completeness	Explicitly answers both what it does (scanning/detection) and when to use it via an explicit 'Use when:' clause with five triggers.	3 / 3
Trigger Term Quality	Natural triggers users would say ('scan Terraform files', 'IaC scan', 'Kubernetes manifests', 'CloudFormation or ARM template security') give good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	Clear niche (IaC pre-deployment security scanning) with distinct, specific triggers unlikely to fire for unrelated skills; uses third-person voice.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: snyk/studio-recipes
Commit: fffe731

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.