Terraform Reviewer

Review Terraform plans and HCL files for AWS security misconfigurations before deployment

This skill appears coherent and does what it says: analyze pasted Terraform HCL or terraform plan JSON for AWS security issues. It does not ask for credentials. IMPORTANT: terraform plan and especially terraform state can contain secrets or sensitive values — do not paste API keys, passwords, private keys, or any sensitive environment variables into the chat. If you are unsure, sanitize or redact values, or share only the resource blocks necessary for review. Prefer sharing terraform show -json output that you have inspected and scrubbed, or use local tools (tfsec, checkov, terrascan) if you cannot safely redact data. If you want extra assurance, ask the reviewer to provide a small sample analysis first (no secrets) to confirm behavior before sending larger outputs.

Type: OpenClaw Skill Name: terraform-reviewer Version: 1.0.0 The skill bundle is classified as benign. The `SKILL.md` clearly defines a security review purpose and explicitly states that the skill is 'instruction-only,' does not execute AWS CLI commands, and does not access AWS accounts directly. It includes strong defensive instructions for the AI agent, such as 'Never ask for credentials, access keys, or secret keys' and to 'confirm no credentials are included before processing' user-provided data. While `bash` is listed as a tool, there are no instructions for the agent to use it for any malicious or risky operations; the `bash` commands provided are for the user to generate input data. There is no evidence of data exfiltration, malicious execution, persistence, or harmful prompt injection attempts.