Run any Skill in Manus with one click

infra-audit

Stars2

Forks1

UpdatedApril 3, 2026 at 21:29

Audit infrastructure configuration for security and best practices. Reviews Terraform, Docker, CI/CD pipelines, and cloud config for misconfigurations, overly permissive permissions, and missing security controls. Trigger phrases: "infra audit", "terraform review", "docker audit", "infrastructure review", "forge infra-audit", "check infra", "audit infrastructure".

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

brunobracaioli

brunobracaioli/claude-forge

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	infra-audit
description	Audit infrastructure configuration for security and best practices. Reviews Terraform, Docker, CI/CD pipelines, and cloud config for misconfigurations, overly permissive permissions, and missing security controls. Trigger phrases: "infra audit", "terraform review", "docker audit", "infrastructure review", "forge infra-audit", "check infra", "audit infrastructure".
argument-hint	[optional: specific path — terraform/, Dockerfile, .github/workflows/]
allowed-tools	Read, Bash, Glob, Grep

Infrastructure Security Audit

Review all infrastructure-as-code for security misconfigurations and best practices.

Workflow

Step 1: Discover IaC Files

Scan for:
- terraform/**/*.tf
- Dockerfile, docker-compose*.yml
- .github/workflows/*.yml, .gitlab-ci.yml, Jenkinsfile
- kubernetes/*.yaml, k8s/*.yaml, helm/**
- serverless.yml, vercel.json, netlify.toml
- ansible/**/*.yml, pulumi/**

If $ARGUMENTS is provided, audit only that path.

Step 2: Terraform Audit

For each .tf file found:

State & Backend

Remote backend configured (not local state)?
State encryption enabled?
State locking configured (DynamoDB/GCS)?

IAM & Permissions

No wildcard (*) in IAM policy actions or resources
No inline policies (use managed or customer policies)
Each service has its own role (no shared roles)
No AdministratorAccess or PowerUser attached

Network

No security groups with 0.0.0.0/0 on non-HTTP ports
Private subnets for databases and internal services
VPC flow logs enabled
No public IPs on internal services

Data

Encryption at rest on all storage (S3, RDS, EBS, DynamoDB)
Encryption in transit (TLS)
No public S3 buckets unless explicitly intended
Backup and point-in-time recovery enabled on databases
Secrets in AWS Secrets Manager/SSM, not in variables

Compute

ECR image scanning enabled
ECS tasks with non-root users
Container health checks defined
CloudWatch/monitoring enabled

Step 3: Docker Audit

For each Dockerfile:

Multi-stage build (no dev deps in final image)?
Non-root USER directive?
Specific base image tags (no :latest)?
No secrets in build args or COPY
HEALTHCHECK defined?
.dockerignore exists and excludes .env, .git, node_modules?

For docker-compose files:

No hardcoded passwords (use env_file or secrets)
Volumes don't mount sensitive host paths
No privileged mode unless required
Resource limits defined for production

Step 4: CI/CD Pipeline Audit

For each workflow/pipeline:

No secrets hardcoded in workflow files
Secrets passed via GitHub Secrets / CI variables
Actions/images pinned to specific versions (no @latest)
GITHUB_TOKEN has minimal permissions (not write-all)
No artifact uploads containing secrets
Deployment requires approval for production
OIDC preferred over long-lived access keys

Step 5: Report

## Infrastructure Audit Report
Date: <timestamp>
Scope: <path or "all IaC">

### IaC Files Found
- Terraform: X files
- Docker: X files
- CI/CD: X workflows
- Other: ...

### Critical
- [CATEGORY] <finding> — file:line
  Risk: <what could happen>
  Fix: <specific remediation>

### High
...

### Medium
...

### Best Practice Recommendations
- <actionable suggestion>

More from this repository

same repository

claude-forge

brunobracaioli/claude-forge

Bootstrap the complete .claude/ directory structure for any new project with replicable templates, CLAUDE.md, rules, skills, agents, hooks, and settings. Use this skill whenever the user says "bootstrap project", "mount project structure", "setup claude code", "initialize .claude", "start new project", "monte a estrutura do projeto", "prepare project for claude code", "scaffold claude config", or any variation asking to set up Claude Code configuration for a new or existing codebase. Also trigger when the user asks to "create CLAUDE.md template", "setup skills", or wants a replicable project skeleton. Supports stack-specific variants including django, flask-next, go, laravel, node, python, react, and rust. Supports architecture presets: mvp (monolith, Supabase+Vercel), production-aws (multi-service, Terraform, AWS: VPC + RDS + ECS Fargate), or production-gcp (multi-service, Terraform, GCP: VPC + Cloud SQL + Cloud Run, WIF-based CI/CD).

2026-04-222

spec-build

brunobracaioli/claude-forge

Spec-driven project build using Agent Teams. Reads a SPEC.md file (or receives a feature description), creates a shared API contract, then spawns a multi-agent team to implement backend and frontend in parallel. Includes security validation and checkpoint creation on success. Use when the user says "build from spec", "implement the spec", "spec-build", "build this project", "monte o projeto a partir do spec", or wants to go from specification to working code using parallel agents.

2026-04-032

checkpoint

brunobracaioli/claude-forge

Create a development checkpoint: run tests, commit clean state, tag with version, and save context summary for session continuity. Use when you want to mark a stable point in development before switching context, ending a session, or starting a risky change. Trigger phrases: "checkpoint", "save progress", "mark stable", "create checkpoint", "snapshot", "save state", "forge checkpoint".

2026-04-032

pentest-recon

brunobracaioli/claude-forge

Perform passive reconnaissance and attack surface mapping from the codebase. Identifies exposed endpoints, auth flows, input vectors, and potential attack paths for authorized security testing. For use in pentesting engagements, CTF, or internal security assessments only. Trigger phrases: "pentest recon", "attack surface", "map endpoints", "recon", "forge pentest-recon", "threat model", "attack surface mapping".

2026-04-032

security-audit

brunobracaioli/claude-forge

Run a comprehensive OWASP-based security audit on the codebase. Checks for injection, broken auth, sensitive data exposure, misconfigurations, and known vulnerable dependencies. Trigger phrases: "security audit", "owasp check", "security review", "vuln scan", "forge security-audit", "check security".

2026-04-032

commit

brunobracaioli/claude-forge

Stage changes, generate a conventional commit message, and commit.

2026-03-302

name	infra-audit
description	Audit infrastructure configuration for security and best practices. Reviews Terraform, Docker, CI/CD pipelines, and cloud config for misconfigurations, overly permissive permissions, and missing security controls. Trigger phrases: "infra audit", "terraform review", "docker audit", "infrastructure review", "forge infra-audit", "check infra", "audit infrastructure".
argument-hint	[optional: specific path — terraform/, Dockerfile, .github/workflows/]
allowed-tools	Read, Bash, Glob, Grep

Infrastructure Security Audit

Review all infrastructure-as-code for security misconfigurations and best practices.

Workflow

Step 1: Discover IaC Files

Scan for:
- terraform/**/*.tf
- Dockerfile, docker-compose*.yml
- .github/workflows/*.yml, .gitlab-ci.yml, Jenkinsfile
- kubernetes/*.yaml, k8s/*.yaml, helm/**
- serverless.yml, vercel.json, netlify.toml
- ansible/**/*.yml, pulumi/**

If $ARGUMENTS is provided, audit only that path.

Step 2: Terraform Audit

For each .tf file found:

State & Backend

Remote backend configured (not local state)?
State encryption enabled?
State locking configured (DynamoDB/GCS)?

IAM & Permissions

No wildcard (*) in IAM policy actions or resources
No inline policies (use managed or customer policies)
Each service has its own role (no shared roles)
No AdministratorAccess or PowerUser attached

Network

No security groups with 0.0.0.0/0 on non-HTTP ports
Private subnets for databases and internal services
VPC flow logs enabled
No public IPs on internal services

Data

Encryption at rest on all storage (S3, RDS, EBS, DynamoDB)
Encryption in transit (TLS)
No public S3 buckets unless explicitly intended
Backup and point-in-time recovery enabled on databases
Secrets in AWS Secrets Manager/SSM, not in variables

Compute

ECR image scanning enabled
ECS tasks with non-root users
Container health checks defined
CloudWatch/monitoring enabled

Step 3: Docker Audit

For each Dockerfile:

Multi-stage build (no dev deps in final image)?
Non-root USER directive?
Specific base image tags (no :latest)?
No secrets in build args or COPY
HEALTHCHECK defined?
.dockerignore exists and excludes .env, .git, node_modules?

For docker-compose files:

No hardcoded passwords (use env_file or secrets)
Volumes don't mount sensitive host paths
No privileged mode unless required
Resource limits defined for production

Step 4: CI/CD Pipeline Audit

For each workflow/pipeline:

No secrets hardcoded in workflow files
Secrets passed via GitHub Secrets / CI variables
Actions/images pinned to specific versions (no @latest)
GITHUB_TOKEN has minimal permissions (not write-all)
No artifact uploads containing secrets
Deployment requires approval for production
OIDC preferred over long-lived access keys

Step 5: Report

## Infrastructure Audit Report
Date: <timestamp>
Scope: <path or "all IaC">

### IaC Files Found
- Terraform: X files
- Docker: X files
- CI/CD: X workflows
- Other: ...

### Critical
- [CATEGORY] <finding> — file:line
  Risk: <what could happen>
  Fix: <specific remediation>

### High
...

### Medium
...

### Best Practice Recommendations
- <actionable suggestion>