Use when reviewing Terraform test files (.tftest.hcl), assessing test coverage, or designing new tests for components using mock_provider and plan-only assertions
From shieldnpx claudepluginhub infraspecdev/tesseract --plugin shieldThis skill uses the workspace's default tool permissions.
templates.mdtest-patterns.mdObserves Claude Code sessions via hooks to create atomic project-scoped instincts with confidence scores, evolving them into skills, commands, or agents.
Automatically extracts reusable patterns like error resolutions, workarounds, and debugging techniques from Claude Code sessions via Stop hook, saving them as learned skills for reuse.
Provides patterns for continuous autonomous agent loops with loop selection, quality gates, evals, recovery controls, and failure mitigation. Useful for production AI agent workflows.
Test quality assessment for Terraform components using the native terraform test framework (.tftest.hcl files). Evaluates coverage across 6 dimensions and provides patterns for mock_provider, override_resource, and plan-only assertions.
.tftest.hcl files for coverage gapsterraform validate / terraform fmtterraform-security-audit skill.tftest.hcl files and you are not asked to create themAssess each component against these 6 dimensions (see test-patterns.md for HCL examples):
run block with command = plan, valid inputs, assertions on key resource attributesvalidation block has a test using expect_failures.tftest.hcl files in the componentvariables.tf to list all required variables, validation blocks, and feature toggle flagsrun block, determine which dimension(s) it coverstemplates.mdvalidation block MUST have a matching expect_failures testmock_provider is required for plan-only tests -- do not rely on real AWS credentialsoverride_resource to provide mock CIDR values since allocations happen at apply time| Mistake | Why It Happens | Correct Approach |
|---|---|---|
| Happy path test with zero assertions | Developer assumes "plan succeeds" is sufficient | Assert on specific resource attributes (count, CIDR, tags) |
Missing expect_failures for validations | Validation blocks seem self-documenting | Every validation block needs an explicit negative test |
| Testing feature toggle in one state only | Enabled state is the default, so it "works" | Test both enabled and disabled; verify resource count is 0 when disabled |
| Hardcoding AZ names without mock | Tests fail in different regions | Use override_data on data.aws_availability_zones |
| Skipping CIDR overlap checks | Subnets "look right" in small configs | Use distinct() assertion to verify no CIDR overlap programmatically |
| No edge case for single AZ | Multi-AZ is the common path | Single-AZ is a valid deployment; test az_count = 1 explicitly |
test-patterns.md -- HCL code examples for each coverage dimension and mock_provider patternstemplates.md -- Coverage assessment output template