菜单
Run Checkmarx KICS for Infrastructure as Code security scanning. Use when analyzing Terraform, CloudFormation, Kubernetes, Ansible, Dockerfile, or other IaC for misconfigurations and security issues.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/igbuend/grimbard --skill kics命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | kics |
| description | Run Checkmarx KICS for Infrastructure as Code security scanning. Use when analyzing Terraform, CloudFormation, Kubernetes, Ansible, Dockerfile, or other IaC for misconfigurations and security issues. |
| allowed-tools | ["Bash","Read","Glob","Grep"] |
Ideal scenarios:
Complements other tools:
Do NOT use this skill for:
# Binary download (Linux)
wget https://github.com/Checkmarx/kics/releases/latest/download/kics_linux_amd64.tar.gz
tar -xzf kics_linux_amd64.tar.gz
kics /usr/local/bin/
wget https://github.com/Checkmarx/kics/releases/latest/download/kics_darwin_amd64.tar.gz
tar -xzf kics_darwin_amd64.tar.gz
kics /usr/local/bin/
brew install kics
docker pull checkmarx/kics:latest
kics version
# Scan current directory
kics scan -p .
# Scan specific path
kics scan -p /path/to/iac
# Scan with minimal output
kics scan -p . --silent
# No color output (for CI)
kics scan -p . --no-color
# Generate SARIF report
kics scan -p /path/to/iac \
--report-formats sarif \
--output-path results.sarif
# Multiple formats (JSON + SARIF)
kics scan -p /path/to/iac \
--report-formats json,sarif \
--output-path .
# Named output
kics scan -p /path/to/iac \
--report-formats sarif \
--output-name kics-results
# All formats
kics scan -p /path/to/iac \
--report-formats all \
--output-path ./reports
# AWS CloudFormation
kics scan -p ./cloudformation --type CloudFormation
# Terraform
kics scan -p ./terraform --type Terraform
# Kubernetes manifests
kics scan -p ./k8s --type Kubernetes
# Dockerfile
kics scan -p ./docker --type Dockerfile
# Ansible
kics scan -p ./ansible --type Ansible
# Azure Resource Manager
kics scan -p ./arm --type AzureResourceManager
# Google Deployment Manager
kics scan -p ./gdm --type GoogleDeploymentManager
# Helm charts
kics scan -p ./charts --type Helm
# Only high and critical
kics scan -p . --minimal-ui --fail-on high,critical
# Exclude info findings
kics scan -p . --exclude-severities info
# Specific severities in SARIF
kics scan -p . \
--fail-on high,critical \
--report-formats sarif \
--output-path results.sarif
Create .kics.yml or kics.config:
# Paths to scan
path: ./infrastructure
# Query selection
exclude-queries:
- 487f4be7-3fd9-4506-a07a-96c39d0b30ad # Specific query ID
# Severity settings
fail-on:
- high
- critical
# Output settings
output-path: ./kics-results
report-formats:
- sarif
- json
- html
# Exclude paths
exclude-paths:
- "./tests/**"
- "./examples/**"
- "**/.terraform/**"
# Exclude results by similarity ID
exclude-results:
- abc123def456
# Platform filters
type:
- Terraform
- Kubernetes
- Dockerfile
# CI mode
ci: true
no-color: true
minimal-ui: true
Use config:
kics scan --config .kics.yml
# Terraform - suppress specific finding
resource "aws_s3_bucket" "example" {
# kics-scan ignore-line
bucket = "my-bucket"
acl = "public-read" # Suppressed above
}
# Suppress entire block
# kics-scan ignore-block
resource "aws_security_group" "example" {
ingress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
# Kubernetes - suppress finding
apiVersion: v1
kind: Pod
metadata:
name: example
spec:
# kics-scan ignore-line
hostNetwork: true # Suppressed
containers:
- name: app
image: nginx:latest # kics-scan ignore-line
name: KICS IaC Scan
on:
push:
branches: [main]
paths:
- '**.tf'
- '**.yaml'
- '**.yml'
- 'Dockerfile*'
pull_request:
paths:
- '**.tf'
- '**.yaml'
- '**.yml'
- 'Dockerfile*'
jobs:
kics:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run KICS
uses: checkmarx/kics-github-action@v2.1.1
with:
path: .
output_path: kics-results
output_formats: 'sarif,json,html'
fail_on: high,critical
enable_comments: true # PR comments
exclude_paths: 'tests/**,examples/**'
- name: Upload SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: kics-results/results.sarif
category: kics
- name: Upload Results
if: always()
uses: actions/upload-artifact@v4
with:
name: kics-results
path: kics-results/
# Comprehensive Terraform scan
kics scan -p ./terraform \
--type Terraform \
--report-formats sarif,html \
--output-path ./security-audit \
--fail-on high,critical
# Review HTML report
open ./security-audit/results.html
# Process SARIF with other tools
sarif summary ./security-audit/results.sarif
# Scan all K8s manifests
kics scan -p ./k8s \
--type Kubernetes \
--report-formats sarif \
--output-name k8s-security
# Focus on critical issues
kics scan -p ./k8s \
--type Kubernetes \
--fail-on high,critical \
--exclude-severities low,medium,info
# Scan mixed IaC
kics scan -p ./infrastructure \
--type Terraform,CloudFormation,AzureResourceManager \
--report-formats sarif,json \
--output-path ./reports
# Scan all Dockerfiles
kics scan -p . \
--type Dockerfile \
--report-formats sarif \
--output-name dockerfile-scan
# Include docker-compose
kics scan -p . \
--type Dockerfile,DockerCompose \
--report-formats sarif
KICS SARIF v2.1.0 includes:
| Category | Examples |
|---|---|
| Access Control | Overly permissive IAM, public resources |
| Encryption | Unencrypted storage, weak TLS |
| Networking | Open security groups, exposed ports |
| Secret Management | Hardcoded credentials, exposed secrets |
| Resource Configuration | Missing logging, backup disabled |
| Best Practices | Missing tags, resource limits |
| Insecure Defaults | Default passwords, debug mode |
Create custom query in custom-queries/:
# custom-queries/require_tags.rego
package Cx
CxPolicy[result] {
resource := input.document[i].resource.aws_instance[name]
not resource.tags
result := {
"documentId": input.document[i].id,
"searchKey": sprintf("aws_instance[%s]", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": "Tags should be defined",
"keyActualValue": "Tags are not defined"
}
}
Use custom queries:
kics scan -p ./terraform \
--queries-path ./custom-queries \
--report-formats sarif
# List all queries
kics list-platforms
# Show query details
kics show-query <query-id>
# Generate queries documentation
kics generate-documentation
# Generate baseline
kics scan -p . --report-formats json -o baseline.json
# Compare against baseline
kics scan -p . --exclude-results $(cat baseline.json | jq -r '.results[].similarity_id')
KICS maps findings to:
# Filter by compliance
kics scan -p . --include-queries "CIS*" --report-formats sarif
# Parallel scanning (default: number of CPUs)
kics scan -p . --parallel 8
# Limit file size
kics scan -p . --file-size-limit 1000 # KB
# Exclude large directories
kics scan -p . --exclude-paths "**/node_modules/**,**/.terraform/**"
# Minimal UI for speed
kics scan -p . --minimal-ui --silent --no-progress
| Shortcut | Why It's Wrong |
|---|---|
| "KICS found nothing = IaC is secure" | KICS has 1500+ queries but can't cover every misconfiguration |
| "Suppress all LOW/MEDIUM findings" | Lower severity findings can combine to create critical risks |
| "Skip IaC scanning in CI" | IaC defines infrastructure; security issues here affect entire environment |
| "Only scan before deployment" | Early detection in development prevents costly late-stage fixes |
| "Ignore platform-specific queries" | Platform-specific checks catch cloud provider misconfigurations |