What problem does it solve? After an infrastructure-as-code security audit, teams face long lists of findings mixed with false positives and inflated severity scores. This Skill re-verifies each finding against the actual template lines, checks for compensating controls, tests whether a realistic exploitation path exists, and produces a final high-confidence finding set that a security team can act on without manual triage. ## Core Features & Use Cases - Evidence Re-verification: Re-reads the cited template lines for every Stage 3 finding to confirm the described pattern actually exists in the code. - Severity Reassessment: Recalculates CVSSv3.1 scores using environmental context (tier, internet exposure, data classification) and compensating controls, downgrading or rejecting findings with no practical exploitation path. - Auditable Output: Writes CIS_FINDINGS_REVISITED.md, TM_FINDINGS_REVISITED.md, and OVERALL_FINDINGS_REVISITED.md with confirmed, revised, informational, and rejected findings, including rejection reasons for a full audit trail. - Use Case: After running /iac-audit on a Terraform or CloudFormation project, run this Skill to remove false positives, adjust severity scores, and hand a prioritized remediation list to the engineering team. ## Quick Start Run /iac-reassess on the project directory to validate the findings from the previous IaC audit and produce the final revisited findings report.
