skills.rest
naporin0624
naporin0624COMMUNITY
Explore all skills by this author →
Website𝕏@naporin24690GitHub

iac-scanner

Detect security misconfigurations in Infrastructure as Code using tfsec and Checkov.

3|1|Updated Dec 23, 2025
Search Tags:#security#kubernetes#terraform#iac#tfsec#checkov
One-click install
npx skills add https://github.com/naporin0624/claude-web-audit-plugins --skill iac-scanner
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: iac-scanner
Source: https://github.com/naporin0624/claude-web-audit-plugins/tree/main/skills/iac-scanner
Command: npx skills add https://github.com/naporin0624/claude-web-audit-plugins --skill iac-scanner

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill wraps tfsec and Checkov to detect misconfigurations across Terraform, Kubernetes, CloudFormation, and more.

Core Features & Use Cases

  • Auto-detects framework and selects the appropriate scanner.
  • Outputs JSON with findings and a concise summary.
  • Supports Terraform and multi-cloud IaC coverage.

Quick Start

Example: npx iac-scanner .

Frequently Asked Questions about iac-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Terraform code for security misconfigurations?▼

Scan Terraform for security misconfigurations using IaC scanning tools that detect policy violations and insecure configurations. Run `npx iac-scanner .` in your Terraform directory to auto-detect the framework and output JSON findings with a summary.

Can I scan Kubernetes manifests and CloudFormation templates for security issues?▼

Yes, IaC scanning covers Kubernetes, CloudFormation, Terraform, and other frameworks. The scanner auto-detects your framework type and runs the appropriate security checks, outputting standardized JSON results.

What's the difference between tfsec and Checkov for Infrastructure as Code scanning?▼

Both tfsec and Checkov detect IaC misconfigurations but cover different frameworks and rulesets. This scanner wraps both tools and auto-selects the right one based on your code type, or you can force a specific scanner if needed.

How do I integrate IaC security scanning into my CI/CD pipeline?▼

IaC scanners output structured JSON findings with version and timestamp metadata, enabling programmatic integration. Use the JSON output to fail builds on critical violations or feed results into security dashboards and reporting systems.

Do I need to install tfsec and Checkov separately to use IaC scanning?▼

No, the scanner wraps tfsec and Checkov internally, handling framework detection and tool selection automatically. Run it directly without manual setup or pre-installation of individual scanning tools.

What IaC frameworks are supported by security scanning tools?▼

IaC security scanning supports Terraform, Kubernetes, CloudFormation, and other Infrastructure as Code frameworks. The scanner auto-detects your framework and applies the appropriate security checks, or you can specify the framework explicitly.

Related Skills

Explore More Software Engineering Skills→
lgbarnlgbarn
66

infrastructure-validation

Validate Terraform, Ansible, Docker, and CloudFormation configurations with formatting, syntax, linting, and security checks.

Community
Advanced
jiayaoqijiajiayaoqijia
98

security-report

Compile security scan findings into structured Markdown, HTML, or JSON reports.

Community
Advanced
andisabandisab

security-validation

Automate security scanning and policy validation for Infrastructure as Code resources.

Community
Advanced
devendrapratapsinghdevendrapratapsingh
1

platform-security

Audit container images, Kubernetes configurations, cloud environments, and infrastructure as code for security vulnerabilities.

Community
Advanced