oimiragieo
oimiragieo/agent-studio
相关职业SOC
基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/oimiragieo/agent-studio --skill terraform-infra命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Agent frontmatter enhancements — disallowedTools, mcpServers scoping, fork_eligible field
Context management — pre-compact persistence, threshold alignment, microcompact/circuit breaker detection
Hook enhancements — updatedInput for bash safety prefixes, suppressOutput for verbose blocks, denial-based routing feedback
正在显示 SKILL.md
基于 SOC 职业分类
| name | terraform-infra |
| description | Terraform infrastructure operations with safety controls |
| version | 1.1.0 |
| model | sonnet |
| invoked_by | both |
| user_invocable | true |
| tools | ["Bash","Read","Glob"] |
| best_practices | ["Always run plan before apply","Review plan output carefully","Never force push to production"] |
| error_handling | graceful |
| streaming | supported |
| verified | true |
| lastVerifiedAt | "2026-02-22T00:00:00.000Z" |
| source | builtin |
| trust_score | 100 |
| provenance_sha | 8b169d711eee942c |
The skill invokes the Terraform CLI. Install:
brew tap hashicorp/tap && brew install hashicorp/tap/terraformchoco install terraform or download from HashiCorpsudo apt update && sudo apt install terraform (see HashiCorp install)Verify: terraform --version
Workflow: terraform init → terraform fmt → terraform validate → terraform plan -out=tfplan → review → terraform apply tfplan. Use terraform show tfplan to inspect.
Hacks: Always run plan before apply; never apply blind. Use remote state (e.g. S3 + lock) for team work. Prefer -auto-approve only in CI with reviewed plans. Use terraform state list and terraform state show <resource> to debug. Use service accounts / workload identity in pipelines; avoid static keys.
HashiCorp Terraform Associate (004): IaC concepts, Terraform fundamentals, state, modules, Terraform Cloud. Learning path. Skill data: init → fmt → validate → plan -out → apply; remote state; no blind apply.
Suggested hooks: Pre-apply: run terraform plan -out=tfplan and gate on review. CI: apply only after plan approval. Use with devops (primary).
Workflows: Use with devops (primary). Flow: init → plan → review → apply; use state commands for debugging. See ci-cd-implementation-rule for pipeline integration.
Provides 90%+ context savings vs raw Terraform MCP server. Includes critical safety controls for infrastructure operations.
| Tool | Description | Confirmation |
|---|---|---|
| plan | Generate terraform plan | No |
| validate | Validate configuration | No |
| fmt | Format terraform files | No |
| Tool | Description | Confirmation |
|---|---|---|
| show | Display current state | No |
| list | List state resources | No |
| state-mv | Move resource in state | Yes |
| Tool | Description | Confirmation |
|---|---|---|
| workspace-list | List workspaces | No |
| workspace-select | Select workspace | No |
| workspace-new | Create workspace | Yes |
| Tool | Description | Confirmation |
|---|---|---|
| apply | Apply changes | REQUIRED |
| Tool | Status |
|---|---|
| destroy | BLOCKED |
| state-rm | BLOCKED |
# Initialize
terraform init
# Plan changes
terraform plan -out=tfplan
# Validate
terraform validate
# Apply (requires -auto-approve for automation)
terraform apply tfplan
⚠️ terraform apply ALWAYS requires confirmation ⚠️ terraform destroy is BLOCKED by default ⚠️ State modifications require confirmation ⚠️ Review plan output before apply
| Issue | Solution |
|---|---|
| Init failed | Check provider credentials |
| State locked | Check for other operations |
| Plan failed | Review error output carefully |
Structure modules following HashiCorp conventions:
modules/
vpc/
main.tf # Resource definitions
variables.tf # Input variables
outputs.tf # Output values
versions.tf # Required provider versions
README.md # Module documentation
| Practice | Description |
|---|---|
| Single responsibility | Each module manages one logical resource group |
| Typed variables | Use type constraints on all variables |
| Validation blocks | Add validation {} for input constraints |
| Sensitive outputs | Mark secrets with sensitive = true |
| Version constraints | Pin module source versions |
# Local module
module "vpc" {
source = "./modules/vpc"
}
# Terraform Registry
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 5.0"
}
# Git source (pinned tag)
module "vpc" {
source = "git::https://github.com/org/modules.git//vpc?ref=v1.2.0"
}
package provider
import (
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
)
func Provider() *schema.Provider {
return &schema.Provider{
Schema: map[string]*schema.Schema{
"api_key": {
Type: schema.TypeString,
Required: true,
Sensitive: true,
DefaultFunc: schema.EnvDefaultFunc("API_KEY", nil),
},
},
ResourcesMap: map[string]*schema.Resource{
"myservice_resource": resourceMyServiceResource(),
},
}
}
# Validate module syntax
cd modules/vpc && terraform validate
# Run module tests (Terraform 1.6+)
terraform test
# Plan with module
terraform plan -var-file=examples/basic.tfvars
terraform plan and review the output before executing terraform apply.tf files — use secret managers (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault)terraform state commands exclusively| Anti-Pattern | Why It Fails | Correct Approach |
|---|---|---|
| Hardcoded credentials in .tf files | Secret exposure in VCS, compliance failure | Use variables with secret manager backend |
| No state locking | Concurrent applies corrupt state | Enable backend locking (S3+DynamoDB, Azure Blob, GCS) |
terraform apply without plan review | Unexpected resource deletion or recreation | Always plan first, review diff, then apply |
| Unversioned providers and modules | Non-reproducible builds and breaking changes | Pin versions: version = "~> 4.0" |
| Untagged resources | Untrackable costs and compliance failure | Tag all resources with env, owner, cost-center |
Before starting:
Read .claude/context/memory/learnings.md
After completing:
.claude/context/memory/learnings.md.claude/context/memory/issues.md.claude/context/memory/decisions.mdASSUME INTERRUPTION: If it's not in memory, it didn't happen.