How to use the Auditing Terraform security agent skill

What the skill makes the agent do

Terraform is the code that defines cloud infrastructure such as storage buckets, permissions and firewall rules. This skill guides an agent to review that code for security problems before it is deployed.

The skill tells the agent to run established scanners: Checkov, tfsec and Terrascan. It also covers writing custom OPA/Rego policy rules for organisation standards, and setting up a CI/CD pipeline gate that fails when risky settings are found, such as wildcard IAM permissions, public exposure, missing encryption or open SSH. A bundled Python helper wraps the scanner commands and returns their results as JSON.

• Scans Terraform directories, plan files and modules with Checkov, tfsec and Terrascan
• Writes custom OPA/Rego policies and tests them with Conftest
• Builds a GitHub Actions pipeline step that runs the scans on pull requests
• Audits Terraform state for already-deployed misconfigurations

Install the skill with a ZIP file or the Claude apps

Download the ZIP for this skill from this page and unzip it. For a personal setup, put the unzipped skill folder in ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.

If you use the Claude apps, you can instead upload the skill under Settings, then Capabilities, then Skills.

The skill's files are SKILL.md, scripts/agent.py and references/api-reference.md. Keep them together in the same folder.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings, then Capabilities, then Skills, then upload

Install the tools the skill depends on

The skill does not replace the scanners. It tells the agent to run them, so each one must be installed on the machine where the agent works. The source lists these prerequisites.

Checkov is installed with pip. tfsec and Terrascan are installed with Homebrew, or tfsec can be downloaded as a binary from GitHub. OPA and Conftest are needed for custom policies. Terraform is needed to generate plan files, and your code must be in a Git repository.

• Python
• Checkov (pip install checkov)
• tfsec (brew install tfsec, or a binary from GitHub)
• Terrascan (brew install terrascan)
• Terraform, for plan generation
• OPA (Open Policy Agent) and Conftest, for custom policies
• A Git repository containing your Terraform code
• Optional: a Bridgecrew/Prisma Cloud API key in BRIDGECREW_API_KEY, only for the Checkov skip example

Trigger the skill with a natural request

You do not need special syntax. Describe the task in plain language and mention Terraform and security. The agent should pick up the skill when your request matches its purpose.

Good requests name the folder or plan file and say what you want back, such as a list of failing checks, a JSON report or a pipeline change.

• Review the Terraform in ./terraform/ for security misconfigurations before I apply it.
• Scan my Terraform plan for public storage buckets and wildcard IAM permissions.
• Write an OPA policy that blocks SSH open to 0.0.0.0/0 in our security group rules.
• Add a CI gate to our pull requests that fails on critical Terraform findings.
• Audit the existing Terraform state for resources missing an Environment tag.

Understand the scanner commands the agent runs

The skill's workflow uses one command per scanner as a starting point. Checkov scans a directory or a plan file. tfsec can filter by minimum severity and write JSON or SARIF output. Terrascan can run against AWS policies and compliance categories.

The source also shows Terraform plan generation, which the agent uses for more accurate analysis. Expect the agent to adapt these commands to your project rather than run them unchanged.

• Checkov: directory scan, plan file scan, JSON output, module scan
• tfsec: minimum severity filter, JSON output, custom check directory, SARIF output for the GitHub Security tab
• Terrascan: AWS scan with Terraform input, JSON output, plan file scan, policy listing

Safety notes: scripts and network access

This skill runs scripts and uses the network. The bundled helper in scripts/agent.py runs scanner commands on your machine, so review it before you install the skill, and only use it on code you are allowed to scan.

The optional Checkov skip example uses a Bridgecrew/Prisma Cloud API key. Keep that key in an environment variable such as BRIDGECREW_API_KEY and do not paste it into prompts or commit it to Git.

The skill only analyses code and plans. The source says runtime monitoring of live cloud accounts should use CSPM tools, and drift detection after deployment should use services such as AWS Config or Azure Policy.

• Read scripts/agent.py before running it on sensitive code
• Store API keys in environment variables, not in files
• Use CSPM tools for live cloud monitoring, which this skill does not cover

Tips for getting useful results

Scan the Terraform plan as well as the source. The source says plan-based analysis is more accurate, because it reflects what Terraform will actually create.

Set a severity threshold early so the output is manageable. For pull requests, decide whether the gate should fail or only report, since the source's examples use a soft-fail option for tfsec in some cases and a hard fail for Checkov.

• Scan modules separately as well as the root directory
• Use the JSON output when you want the agent to summarise results
• Keep custom OPA policies in one folder so Conftest can test them together
• Application security testing (SAST/DAST) is outside this skill's scope