testland/checkov-policy
Configures Checkov for IaC security scanning across Terraform, CloudFormation, Kubernetes, Helm, ARM, Serverless, AWS CDK - `pip install checkov`, custom Python checks, SARIF / JUnit output, and `--baseline` gating so CI fails only on new findings in legacy code. Use for the broadest built-in rule set with Python custom checks; for a consolidated new-project scanner (and the tfsec successor) use trivy-config.
68
86%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md describes running the Checkov CLI (e.g., `checkov -d .`, `checkov -f main.tf`, and `checkov -f plan.json`) which ingests IaC file contents from the repository at runtime, and those files are outsider-authored when submitted via PRs.
Where we found it
repository IaC files
content-type · 21 sites
The plugin instructs the agent to run Checkov against repository IaC files (Terraform, CloudFormation, Kubernetes, Helm, ARM, Dockerfiles), which are outsider-authored content when submitted via PRs, and Checkov's output (including file content references) is returned to the agent.
- Audited
- Security analysis