Immutable. This exact content is served forever at /api/v1/blob/3b389c09d3f88999.
---
name: iac-scan
description: 'Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration.'
license: Apache-2.0
allowed-tools: Bash(vulnetix:*) Read Grep Glob
argument-hint: "[--paths file1 file2]"
user-invocable: true
model: sonnet
metadata:
outputBudget: short
cooldown: per-session
chain: "verify-fix"
---
# Vulnetix IaC Scan Skill
## Use when
- Pre-apply: scan `*.tf` / `*.tofu` for misconfigurations.
- PR review: catch open security groups, plaintext secrets, IAM wildcards.
- Audit existing infra against compliance baselines (CIS, NIST).
- Detect drift between repo IaC and deployed state.
- Pre-merge: gate on critical findings (e.g. publicly-readable S3).
## Don't use for
- Source-code SAST — use `sast-scan`.
- Dockerfile / container analysis — use `container-scan`.
- Cloud runtime monitoring — Pix is static-only; use a CSPM for runtime.
## Conventions
Follows `skills/_lib/contract.md`. In short: use the `vulnetix_*` MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes.
## Step 1: Load capabilities
Read `.vulnetix/capabilities.yaml`. Confirm `derived.has_iac: true` or `--paths` provided. Otherwise abort.
## Step 2: Run scan
```bash
vulnetix iac --paths "$PATHS" -o json > .vulnetix/iac.${TIMESTAMP}.json
```
Captures: open security groups, missing encryption, public S3/GCS, IAM wildcards, unpinned providers, secrets in plaintext, missing tags, unencrypted state backends.
## Step 3: Render
| Severity | File:Line | Resource | Issue | Recommendation |
Group by file. For each high-severity issue, include a 2-3 line code example of the fix.
## Step 4: Risk overlay
If `binaries.terraform: true` (or `tofu`), suggest:
```bash
terraform plan -no-color | head -200 # for context on what would change
```
Don't run `terraform apply` from the skill.
## Memory update
`.vulnetix/iac/<timestamp>.summary.yaml` with finding counts.
## Edge cases & gotchas
- Requires `derived.has_iac: true` OR explicit `--paths`. CWD without `*.tf` files = empty result.
- Detection is static — it cannot evaluate runtime variable interpolation. `var.environment == "prod"` conditional logic is reported as both branches.
- `terraform plan` integration is suggestive only — the skill does NOT run `terraform plan` automatically (state access concerns).
- Provider-specific rules (AWS / GCP / Azure) are detected via resource type prefixes; modules wrapping resources may obscure the type.
- Pre-existing infra not present in IaC (`terraform import` candidates) is not detected.
- k8s manifest support is limited to top-level YAML in `*.yaml` files with kind: matching common workload types.