Use when auditing Terraform code for security vulnerabilities, reviewing IAM policies, checking encryption, or validating network isolation in AWS components
From shieldnpx claudepluginhub infraspecdev/tesseract --plugin shieldThis skill uses the workspace's default tool permissions.
audit-dimensions.mdtemplates.mdImplements structured self-debugging workflow for AI agent failures: capture errors, diagnose patterns like loops or context overflow, apply contained recoveries, and generate introspection reports.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Deep security audit for Terraform AWS components that complements Checkov static analysis. This skill catches patterns that automated scanners miss: overly broad IAM policies, NACL ephemeral port gaps, encryption using AWS-managed keys instead of CMKs, and policy documents that are technically valid but operationally dangerous.
terraform validate instead.tf files in the componentaws_iam_policy_document and inline policy. Expand wildcards, verify resource scoping, check conditions on sensitive actions, flag "*" in actions or resourcestemplates.mdSee audit-dimensions.md for detailed check tables and verification steps for each dimension.
These are the highest-priority items to flag:
Effect = "Allow" with Action = "*" or Resource = "*"::/0 (IPv6 internet)aws/s3 or aws/rds managed keys instead of CMKskms_key_idsts:ExternalId condition| Mistake | Why It Happens | Correct Approach |
|---|---|---|
| Reporting only Checkov findings | Over-reliance on scanner output | Checkov is the baseline; manually expand wildcards and trace network paths |
| Ignoring IPv6 rules | IPv4 rules look secure | Always check both cidr_blocks and ipv6_cidr_blocks on every SG rule |
Treating aws/s3 default key as sufficient | Encryption is technically present | CMK is required for key rotation control and cross-account grant ability |
| Skipping egress rule review | Egress defaults to allow-all | Sensitive subnets need explicit egress restrictions |
| Accepting vague Checkov skip reasons | Skip exists so it must be intentional | Every skip must have a specific, meaningful justification |
| Missing log/backup encryption gaps | Main resource is encrypted | Cross-check that CloudWatch logs, replicas, and backups also use CMKs |
audit-dimensions.md -- Detailed check tables for IAM, network, encryption, and Checkov dimensionstemplates.md -- Report output template