skills.rest
real-case
real-caseCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sec-iac

Reviews Terraform, Kubernetes, Docker, and CloudFormation configurations for security misconfigurations and compliance gaps.

Updated Apr 16, 2026
Search Tags:#cloudformation#kubernetes#docker#terraform#misconfiguration#cis benchmark#iac security
One-click install
npx skills add https://github.com/real-case/marvin-toolkit --skill sec-iac-real-case
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sec-iac
Source: https://github.com/real-case/marvin-toolkit/tree/main/plugins/marvin/skills/sec-iac
Command: npx skills add https://github.com/real-case/marvin-toolkit --skill sec-iac-real-case

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Infrastructure misconfigurations like open security groups, unencrypted storage, and privileged containers are a leading cause of cloud breaches, and they are easy to miss in manual code review. This Skill scans Infrastructure-as-Code files before deployment to catch IAM over-permissioning, exposed endpoints, weak encryption, and container security issues. ## Core Features & Use Cases - Multi-platform IaC detection: Automatically identifies Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles, docker-compose, Pulumi, and Ansible files in the repository. - External scanner integration: Dispatches tfsec, trivy, checkov, kubesec, kube-score, hadolint, and cfn-lint when installed, falling back to manual review when they are not. - Structured findings with fixes: Produces a severity-ranked report at .marvin/security/iac-report.md with CIS benchmark mappings, concrete code fixes, and a machine-readable audit-report block. - Use Case: Before promoting a Terraform module to production, ask for an IaC review to catch a publicly accessible S3 bucket and a container running as root, each with the exact HCL or Dockerfile fix. ## Quick Start Ask the assistant to review the Terraform and Kubernetes files in this repository for security misconfigurations before deployment.

Frequently Asked Questions about sec-iac

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Terraform files for security issues?▼

Run the IaC security review, which detects Terraform files and dispatches tfsec, trivy, or checkov when installed. It also performs a manual review of IAM policies, security groups, encryption settings, and logging configuration, then reports findings with severity and code fixes.

What tools check Kubernetes manifests for security misconfigurations?▼

This review uses kubesec and kube-score for manifest scoring plus trivy for config scanning when available. It also manually checks for root containers, missing network policies, absent resource limits, privileged mode, and overly broad RBAC bindings.

Does the IaC security review work without tfsec or trivy installed?▼

Yes, all external scanners are optional. If none are installed, the review notes the missing tools, recommends installing tfsec, trivy, hadolint, or checkov, and proceeds with a full manual analysis of every detected IaC file.

Can I scan Dockerfiles and docker-compose for security problems?▼

Yes, Dockerfiles are checked with hadolint and manually reviewed for root users, unpinned base images, baked-in secrets, and missing read-only filesystems. Docker Compose files are checked for privileged mode, exposed ports, and sensitive volume mounts like the Docker socket.

Where is the IaC security report saved?▼

The report is written to .marvin/security/iac-report.md alongside other security artifacts. It contains severity-ranked prose findings with CIS benchmark references and a machine-readable audit-report JSON block consumed by the sec-report audit tool.

Related Skills

Explore More Software Engineering Skills→
Yash-AwasthiYash-Awasthi

devops-deployment

Generates CI/CD pipelines, Dockerfiles, Kubernetes manifests, and Terraform infrastructure configurations.

Community
Advanced
kay6198835kay6198835

security-audit

Audit game codebases for security vulnerabilities and generate a prioritized remediation plan.

Community
Advanced
darblexdarblex

Vulnerability Scanner

Detect and prioritize security vulnerabilities in source code repositories.

Community
Advanced
BagelHoleBagelHole
46

policy-as-code

Implement policy as code for automated compliance enforcement with OPA, Sentinel, and Kyverno.

Community
Advanced