The Agent Skills Directory

[SAFE]: The skill serves as a reference guide for infrastructure-as-code best practices and does not contain malicious code or instructions. It promotes security-first workflows by mandating the use of security scanners like tfsec or Checkov before applying changes.
[EXTERNAL_DOWNLOADS]: The CI/CD configuration in reference/cicd-github-actions.md references official and well-known GitHub Actions from HashiCorp, Google, and Aqua Security. These are standard dependencies for infrastructure automation and security testing.
[CREDENTIALS_UNSAFE]: No sensitive credentials, private keys, or API tokens are hardcoded. The skill correctly demonstrates using placeholders for environment variables and Workload Identity Federation for cloud authentication.
[DATA_EXFILTRATION]: There are no indicators of unauthorized data access or network exfiltration. The instructions emphasize the use of remote backend storage for Terraform state files, which is a critical security best practice to avoid exposing sensitive infrastructure details in git repositories.

terraform-skill