Help us improve
Share bugs, ideas, or general feedback.
From shield
Use when auditing Terraform code for security vulnerabilities, reviewing IAM policies, checking encryption, or validating network isolation in AWS components
npx claudepluginhub infraspecdev/tesseract --plugin shieldHow this skill is triggered — by the user, by Claude, or both
Slash command
/shield:security-auditThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Deep security audit for Terraform AWS components that complements Checkov static analysis. This skill catches patterns that automated scanners miss: overly broad IAM policies, NACL ephemeral port gaps, encryption using AWS-managed keys instead of CMKs, and policy documents that are technically valid but operationally dangerous.
Audits Terraform codebases for security in IAM, networking, encryption, secrets, access control, and compliance. Use before production deploys, periodic audits, or new service reviews.
Audits Terraform IaC for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies. Detects permissive IAM, exposed resources, missing encryption before cloud deployment.
Audits Terraform IaC for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies. Detects permissive IAM, public exposures, missing encryption before deployment.
Share bugs, ideas, or general feedback.
Deep security audit for Terraform AWS components that complements Checkov static analysis. This skill catches patterns that automated scanners miss: overly broad IAM policies, NACL ephemeral port gaps, encryption using AWS-managed keys instead of CMKs, and policy documents that are technically valid but operationally dangerous.
terraform validate instead.tf files in the componentaws_iam_policy_document and inline policy. Expand wildcards, verify resource scoping, check conditions on sensitive actions, flag "*" in actions or resourcestemplates.mdSee audit-dimensions.md for detailed check tables and verification steps for each dimension.
These are the highest-priority items to flag:
Effect = "Allow" with Action = "*" or Resource = "*"::/0 (IPv6 internet)aws/s3 or aws/rds managed keys instead of CMKskms_key_idsts:ExternalId condition| Mistake | Why It Happens | Correct Approach |
|---|---|---|
| Reporting only Checkov findings | Over-reliance on scanner output | Checkov is the baseline; manually expand wildcards and trace network paths |
| Ignoring IPv6 rules | IPv4 rules look secure | Always check both cidr_blocks and ipv6_cidr_blocks on every SG rule |
Treating aws/s3 default key as sufficient | Encryption is technically present | CMK is required for key rotation control and cross-account grant ability |
| Skipping egress rule review | Egress defaults to allow-all | Sensitive subnets need explicit egress restrictions |
| Accepting vague Checkov skip reasons | Skip exists so it must be intentional | Every skip must have a specific, meaningful justification |
| Missing log/backup encryption gaps | Main resource is encrypted | Cross-check that CloudWatch logs, replicas, and backups also use CMKs |
audit-dimensions.md -- Detailed check tables for IAM, network, encryption, and Checkov dimensionstemplates.md -- Report output template