skills.rest
marcoguillermaz
marcoguillermazCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

infra-audit

Detect infrastructure security risks in CI/CD and IaC files via static analysis.

3|Updated Mar 17, 2026
Search Tags:#security#kubernetes#docker#terraform#github-actions#ci-cd#infra-audit
One-click install
npx skills add https://github.com/marcoguillermaz/claude-dev-kit --skill infra-audit-marcoguillermaz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: infra-audit
Source: https://github.com/marcoguillermaz/claude-dev-kit/tree/main/packages/cli/templates/tier-m/.claude/skills/infra-audit
Command: npx skills add https://github.com/marcoguillermaz/claude-dev-kit --skill infra-audit-marcoguillermaz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Infrastructure security risks across CI/CD pipelines and IaC artifacts are a perennial source of production risk; this skill automates the detection and signaling of insecure configurations across multiple layers.

Core Features & Use Cases

  • Layer-detection across GitHub Actions, Dockerfiles, Kubernetes manifests, Terraform configurations, and GitLab CI pipelines.
  • Static analysis only, no runtime execution; surfaces findings with severity and remediation guidance.
  • Use case: Scan a repository containing workflows, Dockerfiles, and IaC code to surface misconfigurations and policy violations before deployment.

Quick Start

Run the infra-audit skill to scan your repository for security hotspots.

Frequently Asked Questions about infra-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my repository for infrastructure security risks in Terraform and Kubernetes manifests?▼

To scan for infrastructure security risks, this skill performs static analysis on Terraform configurations and Kubernetes manifests, detecting insecure configurations and reporting findings with severity levels and remediation guidance.

What is static analysis for CI/CD pipelines and how does it detect misconfigurations?▼

Static analysis for CI/CD pipelines examines GitHub Actions and GitLab CI configurations without executing code, applying rule-based checks to detect layer markers and surface insecure configurations with severity levels.

Does this infrastructure audit tool work with Dockerfiles and GitHub Actions workflows?▼

Yes, this infrastructure audit tool works with Dockerfiles and GitHub Actions workflows by implementing specific detection layers that run rule-based checks only for the CI/CD and IaC layers detected in your repository.

Can I automate security audits for GitLab CI pipelines and Terraform configurations?▼

You can automate security audits for GitLab CI pipelines and Terraform configurations by running static analysis that detects these layers and reports policy violations with suggested remediations before deployment.

What is the best way to check IaC artifacts for policy violations before deployment?▼

The best way to check IaC artifacts for policy violations is using static analysis to scan Dockerfiles, Kubernetes manifests, and Terraform configurations, surfacing misconfigurations with severity levels and remediation guidance.

Related Skills

Explore More Software Engineering Skills→
OmexITOmexIT
13

infra-design

Design Docker/Kubernetes/Terraform infrastructure architectures with CI/CD-ready deployment recipes for dev, staging, prod.

Community
Advanced
Dhruvipatel0514Dhruvipatel0514
1

code-auditor

Identify and fix OWASP security vulnerabilities in source code repositories.

Community
Intermediate
alxayoalxayo
17

checkov-security-scan

Detect security misconfigurations and compliance violations in Infrastructure as Code.

Community
Advanced
ddarkrddarkr
5

oma-tf-infra

Automate multi-cloud Terraform infrastructure design, review, and management.

Community
Advanced