Terraform Patterns

Terraform infrastructure-as-code agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Covers module design patterns, state management...

This skill appears to do what it says (Terraform code review and security scanning) and bundles two Python scripts for local analysis. Before installing or running it: 1) Review the two scripts yourself — they run locally and use only the standard library, but inspecting them confirms there are no hidden network calls. 2) Make sure the agent/environment has python3 available (the SKILL.md calls 'python3' but the skill metadata doesn't declare it). 3) Run the scanner only against repositories you control or that do not contain production secrets — the scanner's reports include matched lines and can contain access keys, passwords, or tokens. 4) If you plan to use this in an automated/remote agent, ensure reports are not automatically uploaded to external services or logged where third parties can access them. 5) Prefer skills with a known source/homepage or run the scripts in an isolated environment (local VM or container) if the author is unknown. If you can get confirmation that the skill will redact or redact-sensitive findings and/or the metadata is updated to list python3 as a required binary, I would raise confidence and consider the package coherent.

Type: OpenClaw Skill Name: terraform-patterns Version: 2.1.1 The terraform-patterns skill bundle is a legitimate toolset for auditing and designing Terraform infrastructure. It includes two Python scripts, tf_module_analyzer.py and tf_security_scanner.py, which perform local static analysis on .tf files using regular expressions to identify security risks (like hardcoded AWS keys or open security groups) and structural anti-patterns. The bundle contains no evidence of data exfiltration, malicious execution, or harmful prompt-injection instructions, and its behavior is entirely consistent with its stated purpose of improving IaC quality.