iac-scan

Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags.

Arguments: [--paths file1 file2]

Grants: Bash(vulnetix:*) Read Grep Glob

Typically followed by: verify-fix

Vulnetix IaC Scan Skill

Use when

  • Pre-apply: scan *.tf / *.tofu for misconfigurations.
  • PR review: catch open security groups, plaintext secrets, IAM wildcards.
  • Audit existing infra against compliance baselines (CIS, NIST).
  • Detect drift between repo IaC and deployed state.
  • Pre-merge: gate on critical findings (e.g. publicly-readable S3).

Don’t use for

  • Source-code SAST — use sast-scan.
  • Dockerfile / container analysis — use container-scan.
  • Cloud runtime monitoring — Pix is static-only; use a CSPM for runtime.

Conventions

Follows skills/_lib/contract.md. In short: use the vulnetix_* MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes.

Step 1: Load capabilities

Read .vulnetix/capabilities.yaml. Confirm derived.has_iac: true or --paths provided. Otherwise abort.

Step 2: Run scan

vulnetix iac --paths "$PATHS" -o json > .vulnetix/iac.${TIMESTAMP}.json

Captures: open security groups, missing encryption, public S3/GCS, IAM wildcards, unpinned providers, secrets in plaintext, missing tags, unencrypted state backends.

Step 3: Render

| Severity | File:Line | Resource | Issue | Recommendation |

Group by file. For each high-severity issue, include a 2-3 line code example of the fix.

Step 4: Risk overlay

If binaries.terraform: true (or tofu), suggest:

terraform plan -no-color | head -200    # for context on what would change

Don’t run terraform apply from the skill.

Memory update

.vulnetix/iac/<timestamp>.summary.yaml with finding counts.

Edge cases & gotchas

  • Requires derived.has_iac: true OR explicit --paths. CWD without *.tf files = empty result.
  • Detection is static — it cannot evaluate runtime variable interpolation. var.environment == "prod" conditional logic is reported as both branches.
  • terraform plan integration is suggestive only — the skill does NOT run terraform plan automatically (state access concerns).
  • Provider-specific rules (AWS / GCP / Azure) are detected via resource type prefixes; modules wrapping resources may obscure the type.
  • Pre-existing infra not present in IaC (terraform import candidates) is not detected.
  • k8s manifest support is limited to top-level YAML in *.yaml files with kind: matching common workload types.