Menu
Comprehensive security review of the Terraform provider codebase using gosec, trunk, osv-scanner, and trivy.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Accountability for identifying deprecated Lightdash API usage in the provider by comparing code patterns against the official OpenAPI specification. Use when tasked to audit the codebase for technical debt or outdated API dependencies.
Guide the execution of Lightdash Terraform provider acceptance tests, ensuring correct environment setup and targeted test execution.
Run formatting, linters, unit tests, and build checks, then fix violations.
Implement verified Lightdash API clients with documentation research and live schema verification.
Research and investigate Lightdash API endpoints to understand request/response schemas and behavior.
Implement Terraform Resources and Data Sources in `internal/provider` with comprehensive testing.
| name | security-review |
| description | Comprehensive security review of the Terraform provider codebase using gosec, trunk, osv-scanner, and trivy. |
This skill provides a systematic workflow for auditing the security of the Terraform Provider for Lightdash. It focuses on Go source code, dependencies, and secrets.
Ensure the following tools are installed and available in the PATH:
gosec (Go Security Checker)trunk (Integrated linting and security platform)osv-scanner (Open Source Vulnerability Scanner)trivy (Vulnerability and secret scanner)Run gosec to identify common security pitfalls in Go code.
gosec ./internal/...
Run security-scoped checks using trunk. This includes tools like Semgrep and Gitleaks. We explicitly exclude checkov as per project preference.
trunk check --all --scope security --exclude checkov
Use osv-scanner to check for vulnerabilities in Go dependencies.
osv-scanner scan source -r .
Use trivy to scan the filesystem for vulnerabilities, secrets, and misconfigurations (excluding Checkov-style IaC scans if redundant).
trivy fs . --scanners vuln,secret,config
After running these tools, synthesize the findings into a report with the following sections:
For each significant finding, provide:
Document any findings that are determined to be false positives and why.
Prioritize fixes based on severity and impact.
Always run these checks before major releases or after significant architectural changes.