| name | iac-scan |
| description | Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration. |
| argument-hint | [--paths file1 file2] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["iac scan","terraform scan","tofu scan","kubernetes manifest"] |
| chain | ["verify-fix"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix IaC Scan Skill
Use when
- Pre-apply: scan
*.tf / *.tofu for misconfigurations.
- PR review: catch open security groups, plaintext secrets, IAM wildcards.
- Audit existing infra against compliance baselines (CIS, NIST).
- Detect drift between repo IaC and deployed state.
- Pre-merge: gate on critical findings (e.g. publicly-readable S3).
Don't use for
- Source-code SAST — use
/vulnetix:sast-scan.
- Dockerfile / container analysis — use
/vulnetix:container-scan.
- Cloud runtime monitoring — Pix is static-only; use a CSPM for runtime.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Confirm derived.has_iac: true or --paths provided. Otherwise abort.
Step 2: Run scan
vulnetix iac --paths "$PATHS" -o json > .vulnetix/iac.${TIMESTAMP}.json
Captures: open security groups, missing encryption, public S3/GCS, IAM wildcards, unpinned providers, secrets in plaintext, missing tags, unencrypted state backends.
Step 3: Render
| Severity | File:Line | Resource | Issue | Recommendation |
Group by file. For each high-severity issue, include a 2-3 line code example of the fix.
Step 4: Risk overlay
If binaries.terraform: true (or tofu), suggest:
terraform plan -no-color | head -200
Don't run from the skill.
