One security group rule with cidr_blocks = ["0.0.0.0/0"] on port 22 puts a server in front of every bot on the internet. This skill finds that and ten other risky Terraform settings, and tells you how to fix each one.

Your agent runs a scanner on your .tf and .tfvars files and looks for state files that git would commit, using git's real .gitignore rules. It covers common AWS resources plus GCP and Azure firewall rules, and catches passwords inside maps and URLs such as git module sources. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secret values are never printed.

What it checks

BLOCK (fix before shipping)

• T01: a password, key or token written as a literal string

• T02: SSH, RDP, database or admin ports open to the internet

• T03: a public bucket (public-read ACL or allUsers)

• T04: a state file that .gitignore does not ignore

REVIEW (check before release)

• T11: publicly_accessible = true

• T12: encryption at rest turned off

• T13: an S3 public access block setting set to false

• T14: an IAM policy with Action on Resource

• T15: a module not pinned to a version or tag

• T16: a database with no deletion protection or final snapshot

• T17: an HTTP load balancer listener that does not redirect to HTTPS

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example, and the real report the scanner produces on the risky one

Limits

It reads HCL text and does not evaluate variables, count, for_each or module inputs, read .tf.json files, or see remote state. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 10 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (4 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.