infra-security

Name: infra-security
Availability: InStock
Author: Superagent

Audit Terraform, CloudFormation, Kubernetes, and Docker IaC for security misconfigurations.

76|11|Updated May 18, 2026

Search Tags:#security #cloudformation #compliance #kubernetes #docker #terraform #iac

Ready to run

npx skills add https://github.com/superagent-ai/skills --skill infra-security-superagent-ai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: infra-security
Source: https://github.com/superagent-ai/skills/tree/main/skills/infra-security
Command: npx skills add https://github.com/superagent-ai/skills --skill infra-security-superagent-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Audit Infrastructure-as-Code for security misconfigurations before deployment, reducing risk without live testing or credentials.

Core Features & Use Cases

Stage 1 — a deterministic, dependency-free scanner that reads IaC on disk and flags obvious misconfigurations with file:line anchors and a severity (P0–P3).
Stage 2 — a model-based analysis that adds blast-radius judgment across resources (cross-resource impact) to determine real risk and guide remediation.
Use cases include pre-deployment reviews of Terraform, CloudFormation/SAM, Kubernetes/Helm manifests, and Docker/Docker Compose, or SOC 2 / PCI / ISO security reviews and policy validation.

Quick Start

Run the scanner on your IaC directory to generate a findings report.

Frequently Asked Questions about infra-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Terraform and CloudFormation for security misconfigurations before deployment?▼

You can audit IaC offline by running a dependency-free scanner that reads Terraform and CloudFormation files on disk, flagging misconfigurations with file:line anchors and severity levels from P0 to P3 to support pre-deployment security reviews.

Can I scan Kubernetes Helm manifests and Docker Compose files for security issues?▼

Yes, the scanner targets Kubernetes and Helm manifests alongside Docker and Docker Compose files. It reads these configurations offline to identify security misconfigurations and assigns severity levels to guide remediation before deployment.

What is the best way to check IaC blast-radius and cross-resource impact for security reviews?▼

Evaluating IaC blast-radius involves model-based analysis that judges cross-resource impact to determine real risk. This second stage of scanning guides remediation by adding contextual reasoning across resources beyond initial deterministic misconfiguration flags.

Does IaC security auditing require live cloud credentials or network access?▼

No, IaC security auditing reads configuration files offline to reduce risk without live testing or credentials. It analyzes Terraform, CloudFormation, Kubernetes, and Docker files on disk without executing any cloud changes.

How do I use IaC scanning for SOC 2, PCI, or ISO compliance reviews?▼

Use IaC scanning to generate findings reports with severity levels for formal security audits. It validates infrastructure configurations against compliance requirements by detecting misconfigurations in Terraform, CloudFormation, Kubernetes, and Docker files before deployment.