iac-scan

name	iac-scan
description	Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration.
argument-hint	[--paths file1 file2]
user-invocable	true
allowed-tools	Bash, Read, Glob, Grep, Edit, Write
model	sonnet
triggers	["iac scan","terraform scan","tofu scan","kubernetes manifest"]
chain	["verify-fix"]
outputBudget	short
cooldown	per-session

Vulnetix IaC Scan Skill

Use when

• Pre-apply: scan *.tf / *.tofu for misconfigurations.
• PR review: catch open security groups, plaintext secrets, IAM wildcards.
• Audit existing infra against compliance baselines (CIS, NIST).
• Detect drift between repo IaC and deployed state.
• Pre-merge: gate on critical findings (e.g. publicly-readable S3).

Don't use for

• Source-code SAST — use /vulnetix:sast-scan.
• Dockerfile / container analysis — use /vulnetix:container-scan.
• Cloud runtime monitoring — Pix is static-only; use a CSPM for runtime.

Conventions

This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.

Step 1: Load capabilities

Read .vulnetix/capabilities.yaml. Confirm derived.has_iac: true or --paths provided. Otherwise abort.

Step 2: Run scan

vulnetix iac --paths "$PATHS" -o json > .vulnetix/iac.${TIMESTAMP}.json

Captures: open security groups, missing encryption, public S3/GCS, IAM wildcards, unpinned providers, secrets in plaintext, missing tags, unencrypted state backends.

Step 3: Render

| Severity | File:Line | Resource | Issue | Recommendation |

Group by file. For each high-severity issue, include a 2-3 line code example of the fix.

Step 4: Risk overlay

If binaries.terraform: true (or tofu), suggest:

terraform plan -no-color | head -200    # for context on what would change

Don't run terraform apply from the skill.

Memory update

.vulnetix/iac/<timestamp>.summary.yaml with finding counts.

Edge cases & gotchas

• Requires derived.has_iac: true OR explicit --paths. CWD without *.tf files = empty result.
• Detection is static — it cannot evaluate runtime variable interpolation. var.environment == "prod" conditional logic is reported as both branches.
• terraform plan integration is suggestive only — the skill does NOT run terraform plan automatically (state access concerns).
• Provider-specific rules (AWS / GCP / Azure) are detected via resource type prefixes; modules wrapping resources may obscure the type.
• Pre-existing infra not present in IaC (terraform import candidates) is not detected.
• k8s manifest support is limited to top-level YAML in *.yaml files with kind: matching common workload types.