iac-security
Infrastructure as Code security scanning for Terraform, Kubernetes, CloudFormation, and Azure ARM. Detects misconfigurations, security risks, and compliance violations before deployment. Use when: - User asks to scan Terraform files or modules - User mentions "infrastructure security" or "IaC scan" - User is working with Kubernetes manifests - User asks about CloudFormation or ARM template security - Agent is generating or modifying infrastructure code
85
81%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines its scope (IaC security scanning across four specific platforms), states concrete actions (detecting misconfigurations, security risks, compliance violations), and provides a comprehensive 'Use when' clause with five distinct trigger scenarios. It uses proper third-person voice throughout and includes natural keywords users would employ when needing this capability.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple concrete actions: 'security scanning', 'detects misconfigurations, security risks, and compliance violations', and names specific technologies (Terraform, Kubernetes, CloudFormation, Azure ARM). These are concrete, specific capabilities. | 3 / 3 |
Completeness | Clearly answers both 'what' (IaC security scanning, detecting misconfigurations/security risks/compliance violations) and 'when' with an explicit 'Use when:' clause listing five specific trigger scenarios. | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural trigger terms: 'Terraform files or modules', 'infrastructure security', 'IaC scan', 'Kubernetes manifests', 'CloudFormation', 'ARM template security', and 'infrastructure code'. These are terms users would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche combining infrastructure-as-code with security scanning. The specific technologies (Terraform, Kubernetes, CloudFormation, ARM) and the security/compliance focus make it very unlikely to conflict with general coding or generic security skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
62%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill provides a comprehensive, well-structured workflow for IaC security scanning with clear phases and a verification feedback loop. However, it is overly verbose—remediation examples and format tables inflate the document significantly and should be split into referenced files. The core scanning instructions lack executable specificity, using pseudocode descriptions instead of concrete tool invocations or CLI commands.
Suggestions
Clarify the snyk_iac_scan interface: is it a CLI command, MCP tool, or function? Provide exact invocation syntax (e.g., actual CLI flags or tool call JSON) instead of pseudocode bullet lists.
Move the extensive remediation code examples (Terraform, K8s, CloudFormation fixes) into a separate REMEDIATION.md file and reference it from the main skill with a one-line link per platform.
Remove or condense the Discovery phase indicators and Supported IaC Formats table—Claude already knows how to identify Terraform vs. Kubernetes files. A brief one-liner per format is sufficient.
Trim the domain categorization list in Phase 3 (Network Security, Data Protection, etc.) which restates common knowledge, and instead focus on how the scan tool's output maps to these categories.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is reasonably well-structured but verbose for what it conveys. The supported IaC formats table, discovery phase indicators, and domain categorization lists are largely things Claude already knows. The remediation examples are extensive and useful but could be trimmed or moved to a separate reference file. The 'Core Principle' tagline is unnecessary filler. | 2 / 3 |
Actionability | The scan invocations use pseudocode-style descriptions ('Run snyk_iac_scan with: - path: <directory>') rather than executable commands or proper tool call syntax. The remediation code examples are concrete and copy-paste ready, which is strong, but the core scanning workflow—the primary purpose of the skill—lacks executable specificity. It's unclear whether snyk_iac_scan is a CLI command, an MCP tool, or something else. | 2 / 3 |
Workflow Clarity | The five-phase workflow (Discovery → Scan → Analyze → Remediate → Verify) is clearly sequenced with explicit goals per phase. Phase 5 includes a re-scan verification step with before/after comparison, creating a proper feedback loop. Error handling is addressed in a dedicated section. | 3 / 3 |
Progressive Disclosure | All content is inline in a single monolithic file. The extensive remediation examples for Terraform, Kubernetes, and CloudFormation (which constitute roughly half the document) would be better split into separate reference files. There are no cross-references to external files. The document is well-sectioned internally but doesn't leverage progressive disclosure across files. | 2 / 3 |
Total | 9 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- snyk/studio-recipes
- Commit
9293725
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.