agentdevsl/tf-security-baselines
docker/skills-cache/tf-security-baselines/SKILL.md
AWS security assessment domains, risk rating framework, CIS/NIST reference baselines, and evidence-based finding format. Use when reviewing AWS security posture, assessing risk, or applying CIS/NIST baselines to Terraform configurations.
$ install --global
skillsauthnpx skillsauth add agentdevsl/agentpane tf-security-baselinesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 21, 2026, 1:01 PM48.4s1 file scanned
SKILL.md
- name:
- tf-security-baselines
- description:
- AWS security assessment domains, risk rating framework, CIS/NIST reference baselines, and evidence-based finding format. Use when reviewing AWS security posture, assessing risk, or applying CIS/NIST baselines to Terraform configurations.
- source:
- image
Terraform Security Baselines
Agent Role
Expert in cloud security architecture and AWS Well-Architected Framework's Security Pillar. Identify vulnerabilities, misconfigurations, and compliance gaps with evidence-based, actionable recommendations.
Critical Requirements
- MANDATORY: Every finding requires risk rating (Critical/High/Medium/Low) + justification
- MANDATORY: Every recommendation requires authoritative citation (AWS docs, CIS, NIST, OWASP)
- Evidence-Based: File:line references + code quotes + before/after fixes
- MCP-First: Use AWS Knowledge MCP tools to verify current documentation
- Prioritize: Order findings by severity and exploitation likelihood
Security Domains
- IAM: Least privilege, no wildcards, MFA enforcement, specific resource ARNs
- Data Protection: Encryption at rest/transit, KMS, no hardcoded credentials, ephemeral secrets
- Network Security: Private subnets, security groups deny-all default, no 0.0.0.0/0 ingress
- Logging & Monitoring: CloudTrail, VPC Flow Logs, alerting, CloudWatch
- Resilience: Backup, disaster recovery, multi-AZ, auto-scaling
- Compliance: Regulatory requirements, audit trails, data residency
Risk Rating Classification
| Rating | Action | Examples |
| ----------------- | --------------------- | --------------------------------------------------------------- |
| Critical (P0) | Block deployment | Hardcoded credentials, public S3 with sensitive data, IAM *:* |
| High (P1) | Fix before production | Unencrypted RDS, overly permissive SG, missing CloudTrail |
| Medium (P2) | Fix in current sprint | Missing VPC Flow Logs, no MFA, weak password policy |
| Low (P3) | Add to backlog | Missing resource tags, outdated AMI |
Finding Output Format
### [Issue Title]
**Risk Rating**: [Critical|High|Medium|Low]
**Justification**: [Why this severity]
**Finding**: [Description with file:line]
**Impact**: [Consequences if exploited]
**Recommendation**: [Remediation steps]
**Code Example**: [Before/After HCL]
**Source**: [AWS doc URL]
**Reference**: [CIS/NIST/OWASP citation]
**Effort**: [Low|Medium|High]
Evaluation Standards
- AWS Well-Architected Framework Security Pillar
- AWS Security Best Practices
- CIS AWS Benchmark
- NIST Cybersecurity Framework
- OWASP Cloud Security
- Organizational Constitution (
.foundations/memory/module-constitution.md)
MCP Tool Usage
search_documentation("AWS [service] security")→ Find best practicesread_documentation(url)→ Get authoritative citationsrecommend(page)→ Discover related security contentlist_regions(),get_regional_availability()→ Validate region configs
Module-Specific Security Guidance
When reviewing modules (vs consumer deployments):
- Secure Defaults: Modules MUST enable security features by default (encryption, private access, logging)
- Security Toggles: Expose security features as variables with secure defaults — consumers opt OUT, not IN
- No Credentials: Modules MUST NOT manage provider credentials — inherited from consumers
- Sensitive Marking: Variables and outputs handling secrets MUST use
sensitive = true - Force Destroy: Default to
falsefor safety; examples MAY settruefor testing
Special Considerations
- Dev/Test: Relaxed security allowed but requires justification. No prod data.
- Legacy: Document constraints, provide incremental path, prioritize highest-risk.
- Cost: Acknowledge costs, offer alternatives, NEVER compromise Critical/High for cost.
Related Skills
agentdevsl/docker/skills-cache/tf-runtask
testing
VerifiedTrustedCommunity
--- name: "tf-runtask" description: "Retrieve and display Terraform Cloud/Enterprise run task results for a given run. Use this skill whenever the user asks about run task results, run task checks, task stage statuses, or wants to inspect what run tasks reported for a Terraform Cloud/Enterprise run. Triggers on phrases like "check the run tasks", "what did the run tasks say", "show run task results", "get task results for run-xxx", or any reference to run task outcomes on a specific run." source
5SKILL.mdUpdated Apr 21, 2026
agentdevsl/tf-research
devops
VerifiedTrustedCommunity
Research strategies for AWS documentation, provider docs, and public registry patterns. Use when researching AWS services, investigating provider resources, or studying public registry modules for design patterns.
5SKILL.mdUpdated Apr 21, 2026
agentdevsl/tf-report-template
development
VerifiedTrustedCommunity
Validation results summary template for Phase 4 output. Provides the format for reporting terraform test, validate, fmt, tflint, pre-commit, trivy, and security checklist results.
5SKILL.mdUpdated Apr 21, 2026
agentdevsl/tf-provider-plan
development
VerifiedTrustedCommunity
SDD Phases 1-2 for provider development. Clarify requirements, research, produce provider-design-{resource}.md, and await human approval before any code is written.
5SKILL.mdUpdated Apr 21, 2026