sc-iac

You can detect security misconfigurations in Terraform and Kubernetes by scanning IaC files for insecure patterns like privileged containers and public resources. This skill checks these manifests and outputs structured findings with severity and remediation guidance.

Common Dockerfile security misconfigurations include running containers with root privileges, using insecure defaults, and passing secrets in build args. Scanning your IaC files identifies these anti-patterns and provides actionable remediation steps to secure your container builds.

To prevent script injection in GitHub Actions workflows, scan your CI pipeline definitions to detect insecure patterns and potential secret leakage. This skill analyzes workflow files to identify injection risks and outputs structured findings with guidance to secure your deployment pipelines.

Yes, you can scan infrastructure as code files across Docker, Kubernetes, Terraform, and GitHub Actions simultaneously. This skill covers the full deployment pipeline from build to runtime, applying checks for insecure patterns across all supported formats.

No external dependencies are required to run this IaC security scanner. It operates directly on your infrastructure as code files to detect misconfigurations and generate structured findings without needing additional tools or complex environment setup.

The best way to find exposed secrets and overly permissive IAM policies in Terraform is to run an IaC security scan. This skill analyzes Terraform definitions for public resources and permissive policies, outputting structured findings with severity levels and actionable remediation guidance.