[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DRZY57SMCKX9G79P7FW321":3,"skill-same:01M6DRZY57SMCKX9G79P7FW321":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":39,"repositoryHtmlUrl":40,"repositoryHomepageUrl":6,"ownerHtmlUrl":41,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":42,"install":43,"resources":56},"01M6DRZY57SMCKX9G79P7FW321","terraform-validator",null,"Validate, lint, audit, or plan Terraform\u002F.tf\u002FHCL files; runs tflint, checkov, terraform validate.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30],"terraform","terraform validator","validate","lint","audit","checkov","plan","files","2026-11-10 10:12:30",false,"---\nname: terraform-validator\ndescription: Validate, lint, audit, or plan Terraform\u002F.tf\u002FHCL files; runs tflint, checkov, terraform validate.\n---\n\n# Terraform Validator\n\nComprehensive toolkit for validating, linting, and testing Terraform configurations with automated workflows for syntax validation, security scanning, and intelligent documentation lookup.\n\n## ⚠️ Critical Requirements Checklist\n\n**STOP: You MUST complete these steps in order. Do NOT skip any REQUIRED step.**\n\n| Step | Action | Required |\n|------|--------|----------|\n| 1 | Run `bash scripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>` | ✅ REQUIRED |\n| 2 | Context7 lookup for **ALL** providers (explicit AND implicit); **WebSearch fallback if not found** | ✅ REQUIRED |\n| 3 | **READ** `references\u002Fsecurity_checklist.md` | ✅ REQUIRED |\n| 4 | **READ** `references\u002Fbest_practices.md` | ✅ REQUIRED |\n| 5 | Run `terraform fmt` | ✅ REQUIRED |\n| 6 | Run `tflint` (or note as skipped if unavailable) | Recommended |\n| 7 | Run `terraform init` (if not initialized) | ✅ REQUIRED |\n| 8 | Run `terraform validate` | ✅ REQUIRED |\n| 9 | Run `bash scripts\u002Frun_checkov.sh \u003Cpath>` | ✅ REQUIRED |\n| 10 | Cross-reference findings with `security_checklist.md` sections | ✅ REQUIRED |\n| 11 | Generate report citing reference files | ✅ REQUIRED |\n| 12 | Run regression tests (`bash tests\u002Ftest_regression.sh`) | ✅ REQUIRED |\n| 13 | Run lightweight CI checks (`bash -n`, `py_compile`, smoke) | ✅ REQUIRED |\n\n> **IMPORTANT:** Steps 3-4 (reading reference files) must be completed BEFORE running security scans. The reference files contain remediation patterns that MUST be cited in your report.\n\n> **Context7 Fallback:** If Context7 does not have a provider (common for: random, null, local, time, tls), use WebSearch: `\"terraform-provider-{name} hashicorp documentation\"`\n\n## When to Use This Skill\n\n- Working with Terraform files (`.tf`, `.tfvars`, `.tfstate`)\n- Validating Terraform configuration syntax and structure\n- Linting and formatting HCL code\n- Performing dry-run testing with `terraform plan`\n- Debugging Terraform errors or misconfigurations\n- Understanding custom Terraform providers or modules\n- Security validation of Terraform configurations\n\n## External Documentation\n\n| Tool | Documentation |\n|------|---------------|\n| **Terraform** | [developer.hashicorp.com\u002Fterraform](https:\u002F\u002Fdeveloper.hashicorp.com\u002Fterraform\u002Fdocs) |\n| **TFLint** | [github.com\u002Fterraform-linters\u002Ftflint](https:\u002F\u002Fgithub.com\u002Fterraform-linters\u002Ftflint) |\n| **Checkov** | [checkov.io](https:\u002F\u002Fwww.checkov.io\u002F1.Welcome\u002FQuick%20Start.html) |\n| **Trivy** | [aquasecurity.github.io\u002Ftrivy](https:\u002F\u002Faquasecurity.github.io\u002Ftrivy) |\n\n## Validation Workflow\n\n**IMPORTANT:** Follow this workflow in order. Each step is REQUIRED unless explicitly marked optional.\n\n```\n1. Identify Terraform files in scope\n   ├─> Single file, directory, or multi-environment\n\n2. Extract Provider\u002FModule Info (REQUIRED)\n   ├─> MUST run: bash scripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>\n   ├─> Parse output for providers and modules\n   └─> Use for Context7 documentation lookup\n\n3. Lookup Provider Documentation (REQUIRED)\n   ├─> For EACH provider detected:\n   │   ├─> mcp__context7__resolve-library-id with \"terraform-provider-{name}\"\n   │   ├─> mcp__context7__query-docs for version-specific guidance\n   │   └─> If NOT found in Context7: WebSearch fallback (see below)\n   └─> Note any custom\u002Fprivate providers for WebSearch\n\n4. Read Reference Files (REQUIRED before validation)\n   ├─> MUST READ: references\u002Fsecurity_checklist.md (before security scan)\n   ├─> MUST READ: references\u002Fbest_practices.md (for structure validation)\n   └─> Reference common_errors.md if errors occur\n\n5. Format and Lint (REQUIRED)\n   ├─> MUST run: terraform fmt -recursive (auto-fix formatting)\n   ├─> MUST run: terraform fmt -check -recursive (verify no drift)\n   ├─> RUN: tflint (or note as skipped if unavailable)\n   └─> Report formatting issues\n\n6. Syntax Validation (REQUIRED)\n   ├─> MUST run: terraform init (if not initialized)\n   ├─> MUST run: terraform validate\n   └─> Report syntax errors (consult common_errors.md)\n\n7. Security Scanning (REQUIRED)\n   ├─> MUST run: bash scripts\u002Frun_checkov.sh \u003Cpath>\n   ├─> Analyze policy violations against security_checklist.md\n   └─> Suggest remediations from reference\n\n8. Dry-Run Testing (if credentials available)\n   ├─> terraform plan\n   ├─> Analyze planned changes\n   └─> Report potential issues\n\n9. Regression and Wrapper Determinism Checks (REQUIRED)\n   ├─> MUST run: bash tests\u002Ftest_regression.sh\n   ├─> Confirms parser error handling returns non-zero\n   ├─> Confirms implicit provider detection for docs lookup\n   ├─> Confirms wrapper argument handling is deterministic\n   └─> Confirms checkov wrapper preserves scanner exit code\n\n10. Lightweight CI Checks (REQUIRED)\n   ├─> MUST run: bash -n scripts\u002F*.sh\n   ├─> MUST run: python3 -m py_compile scripts\u002F*.py\n   ├─> MUST run: smoke check for extract wrapper on sample fixture\n   └─> Record command outputs and exit codes\n\n11. Generate Comprehensive Report\n   ├─> Include all findings with severity\n   ├─> Reference best_practices.md for recommendations\n   └─> Offer to fix issues if appropriate\n```\n\n## Required Reference File Reading\n\n**You MUST read these reference files during validation:**\n\n| When | Reference File | Action |\n|------|----------------|--------|\n| **Before security scan** | `references\u002Fsecurity_checklist.md` | Read to understand security checks and remediation patterns |\n| **During validation** | `references\u002Fbest_practices.md` | Read to validate project structure, naming, and patterns |\n| **If errors occur** | `references\u002Fcommon_errors.md` | Read to find solutions for specific error messages |\n| **If using Terraform 1.10+** | `references\u002Fadvanced_features.md` | Read to understand ephemeral values, actions, list resources |\n\n## Required Script Usage\n\n**You MUST use these wrapper scripts instead of calling tools directly:**\n\n| Task | Script | Command |\n|------|--------|---------|\n| **Extract provider\u002Fmodule info** | `extract_tf_info_wrapper.sh` | `bash scripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>` |\n| **Run security scan** | `run_checkov.sh` | `bash scripts\u002Frun_checkov.sh \u003Cpath>` |\n| **Install checkov (if missing)** | `install_checkov.sh` | `bash scripts\u002Finstall_checkov.sh install` |\n\n> **Note:** `extract_tf_info_wrapper.sh` automatically handles the python-hcl2 dependency. If system Python lacks `python-hcl2`, it creates\u002Freuses a cached virtual environment under `~\u002F.cache\u002Fterraform-validator\u002F` by default.\n\n### Script Run Context (REQUIRED)\n\n- Default working directory: `devops-skills-plugin\u002Fskills\u002Fterraform-validator`\n- If running from elsewhere, use absolute script paths:\n  - `bash \u002Fabsolute\u002Fpath\u002Fto\u002Fterraform-validator\u002Fscripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>`\n  - `bash \u002Fabsolute\u002Fpath\u002Fto\u002Fterraform-validator\u002Fscripts\u002Frun_checkov.sh \u003Cpath>`\n  - `bash \u002Fabsolute\u002Fpath\u002Fto\u002Fterraform-validator\u002Fscripts\u002Finstall_checkov.sh install`\n\n## Context7 Provider Documentation Lookup (REQUIRED)\n\n**For EVERY provider detected, you MUST lookup documentation via Context7:**\n\n```\n1. Run extract_tf_info_wrapper.sh to get provider list\n2. For each provider (e.g., \"aws\", \"google\", \"azurerm\"):\n   a. Call: mcp__context7__resolve-library-id with \"terraform-provider-{name}\"\n   b. Call: mcp__context7__query-docs with the resolved ID\n   c. Note version-specific features and constraints\n3. Include relevant provider guidance in validation report\n```\n\n**Example for AWS provider:**\n```\nmcp__context7__resolve-library-id(\"terraform-provider-aws\")\nmcp__context7__query-docs(context7CompatibleLibraryID, \"best practices\")\n```\n\n### Context7 Fallback to WebSearch (REQUIRED)\n\n**If Context7 does not find a provider, you MUST fall back to WebSearch:**\n\n```\n1. If mcp__context7__resolve-library-id returns no results or provider not found:\n   a. Use WebSearch with query: \"terraform-provider-{name} hashicorp documentation\"\n   b. For specific version: \"terraform-provider-{name} {version} documentation site:registry.terraform.io\"\n2. Common providers NOT in Context7 (use WebSearch directly):\n   - random (hashicorp\u002Frandom)\n   - null (hashicorp\u002Fnull)\n   - local (hashicorp\u002Flocal)\n   - time (hashicorp\u002Ftime)\n   - tls (hashicorp\u002Ftls)\n3. Document in report: \"Provider docs via WebSearch (not in Context7)\"\n```\n\n**WebSearch Fallback Example:**\n```\n# If Context7 fails for random provider:\nWebSearch(\"terraform-provider-random hashicorp documentation site:registry.terraform.io\")\n```\n\n> **Note:** HashiCorp utility providers (random, null, local, time, tls, archive, external, http) may not be indexed in Context7. Always fall back to WebSearch for these.\n\n## Detecting Implicit Providers (REQUIRED)\n\n**IMPORTANT:** Providers can be used without being declared in `required_providers`. You MUST detect ALL providers:\n\n### Detection Methods\n\n1. **Explicit Providers:** Listed in `required_providers` block (from extract_tf_info_wrapper.sh output)\n2. **Implicit Providers:** Inferred from resource type prefixes\n\n### Common Implicit Provider Patterns\n\n| Resource Type Prefix | Provider Name | Context7 Lookup |\n|---------------------|---------------|-----------------|\n| `random_*` | `random` | `terraform-provider-random` |\n| `null_*` | `null` | `terraform-provider-null` |\n| `local_*` | `local` | `terraform-provider-local` |\n| `tls_*` | `tls` | `terraform-provider-tls` |\n| `time_*` | `time` | `terraform-provider-time` |\n| `archive_*` | `archive` | `terraform-provider-archive` |\n| `http` (data source) | `http` | `terraform-provider-http` |\n| `external` (data source) | `external` | `terraform-provider-external` |\n\n### Workflow for Complete Provider Detection\n\n```\n1. Parse extract_tf_info_wrapper.sh output\n2. Get providers from \"providers\" array (explicit)\n3. Get resources from \"resources\" array\n4. For EACH resource type:\n   a. Extract prefix (e.g., \"random\" from \"random_id\")\n   b. Check if already in providers list\n   c. If NOT in providers: add as implicit provider\n5. Perform Context7 lookup for ALL providers (explicit + implicit)\n```\n\n### Example\n\nIf `extract_tf_info_wrapper.sh` returns:\n```json\n{\n  \"providers\": [{\"name\": \"aws\", ...}],\n  \"resources\": [\n    {\"type\": \"aws_instance\", ...},\n    {\"type\": \"random_id\", ...}\n  ]\n}\n```\n\nYou MUST lookup BOTH:\n- `terraform-provider-aws` (explicit)\n- `terraform-provider-random` (implicit - detected from `random_id` resource)\n\n## Quick Reference Commands\n\n### Format and Lint\n\n```bash\n# Check formatting (dry-run)\nterraform fmt -check -recursive .\n\n# Apply formatting\nterraform fmt -recursive .\n\n# Run tflint (requires .tflint.hcl config)\ntflint --init              # Install plugins\ntflint --recursive         # Lint all modules\ntflint --format compact    # Compact output\n```\n\n> **TFLint Configuration:** See [TFLint Ruleset documentation](https:\u002F\u002Fgithub.com\u002Fterraform-linters\u002Ftflint\u002Fblob\u002Fmaster\u002Fdocs\u002Fuser-guide\u002Fplugins.md) for plugin setup.\n\n### Validate Configuration\n\n```bash\n# Initialize (downloads providers and modules)\nterraform init\n\n# Validate syntax\nterraform validate\n\n# Validate with JSON output\nterraform validate -json\n```\n\n### Security Scanning\n\n**MUST use wrapper script:**\n```bash\n# Use the wrapper script (REQUIRED)\nbash scripts\u002Frun_checkov.sh .\u002Fterraform\n\n# With specific options\nbash scripts\u002Frun_checkov.sh -f json .\u002Fterraform\nbash scripts\u002Frun_checkov.sh --compact .\u002Fterraform\n```\n\n> **Detailed Security Scanning:** You MUST read `references\u002Fsecurity_checklist.md` before running security scans to understand the checks and remediation patterns.\n\n## Security Finding Cross-Reference (REQUIRED)\n\n**When reporting security findings, you MUST cite specific sections from `security_checklist.md`:**\n\n### Cross-Reference Mapping\n\n| Checkov Check Pattern | security_checklist.md Section |\n|-----------------------|------------------------------|\n| `CKV_AWS_24` (SSH open) | \"Overly Permissive Security Groups\" |\n| `CKV_AWS_260` (HTTP open) | \"Overly Permissive Security Groups\" |\n| `CKV_AWS_16` (RDS encryption) | \"Encryption at Rest\" |\n| `CKV_AWS_17` (RDS public) | \"RDS Databases\" |\n| `CKV_AWS_130` (public subnet) | \"Network Security\" |\n| `CKV_AWS_53-56` (S3 public access) | \"Public S3 Buckets\" |\n| `CKV_AWS_*` (IAM) | \"IAM Security\" |\n| `CKV_AWS_79` (IMDSv1) | \"ECS\u002FEKS\" |\n| Hardcoded passwords | \"Hardcoded Credentials\" |\n| Sensitive outputs | \"Sensitive Output Exposure\" |\n\n### Report Template for Security Findings\n\n```markdown\n### Security Issue: [Check ID]\n\n**Finding:** [Description from checkov]\n**Resource:** [Resource name and file:line]\n**Severity:** [HIGH\u002FMEDIUM\u002FLOW]\n\n**Reference:** security_checklist.md - \"[Section Name]\"\n\n**Remediation Pattern:**\n[Copy relevant code example from security_checklist.md]\n\n**Recommended Fix:**\n[Specific fix for this configuration]\n```\n\n### Example Cross-Referenced Report\n\n````markdown\n### Security Issue: CKV_AWS_24\n\n**Finding:** Security group allows SSH from 0.0.0.0\u002F0\n**Resource:** aws_security_group.web (main.tf:47-79)\n**Severity:** HIGH\n\n**Reference:** security_checklist.md - \"Overly Permissive Security Groups\"\n\n**Remediation Pattern (from reference):**\n```hcl\nvariable \"admin_cidr\" {\n  description = \"CIDR block for admin access\"\n  type        = string\n}\n\nresource \"aws_security_group\" \"app\" {\n  ingress {\n    description = \"SSH from admin network only\"\n    from_port   = 22\n    to_port     = 22\n    protocol    = \"tcp\"\n    cidr_blocks = [var.admin_cidr]\n  }\n}\n```\n\n**Recommended Fix:** Replace `cidr_blocks = [\"0.0.0.0\u002F0\"]` with a variable or specific CIDR range.\n````\n\n### Dry-Run Testing\n\n```bash\n# Generate execution plan\nterraform plan\n\n# Save plan to file\nterraform plan -out=tfplan\n\n# Plan with specific var file\nterraform plan -var-file=\"production.tfvars\"\n\n# Plan with target resource\nterraform plan -target=aws_instance.example\n```\n\n**Plan Output Symbols:**\n- `+` Resources to be created\n- `-` Resources to be destroyed\n- `~` Resources to be modified\n- `-\u002F+` Resources to be replaced\n\n## Handling Missing Tools\n\nWhen validation tools are not installed, follow this recovery workflow:\n\n### Recovery Workflow (REQUIRED)\n\n```\n1. Detect missing tool\n2. Inform user what is missing and why it's needed\n3. Provide installation command\n4. ASK user: \"Would you like me to install [tool] and continue?\"\n5. If yes: Run installation and RERUN the validation step\n6. If no: Note as skipped in report, continue with available tools\n```\n\n### Tool-Specific Recovery\n\n**If checkov is missing:**\n```\n1. Inform: \"Checkov is not installed. It's required for security scanning.\"\n2. Ask: \"Would you like me to install it? I'll use: bash scripts\u002Finstall_checkov.sh install\"\n3. If yes: Run install script, then rerun security scan\n```\n\n**If tflint is missing:**\n```\n1. Inform: \"TFLint is not installed. It provides advanced linting beyond terraform validate.\"\n2. Ask: \"Would you like me to install it?\"\n3. Provide: brew install tflint (macOS) or installation script (Linux)\n```\n\n**If python-hcl2 is missing:**\n```\nThe extract_tf_info_wrapper.sh script handles this automatically by creating\nor reusing a cached venv. No user action required.\n```\n\n**Required tools:** `terraform fmt`, `terraform init`, `terraform validate`\n**Required for full security validation:** `checkov`\n**Optional but recommended:** `tflint`\n\n## Scripts\n\n| Script | Purpose | Usage |\n|--------|---------|-------|\n| `extract_tf_info_wrapper.sh` | Parse Terraform files for providers\u002Fmodules (auto-handles dependencies) | `bash scripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>` |\n| `extract_tf_info.py` | Core parser (requires python-hcl2) | Use wrapper instead |\n| `run_checkov.sh` | Wrapper for Checkov scans with enhanced output | `bash scripts\u002Frun_checkov.sh \u003Cpath>` |\n| `install_checkov.sh` | Install Checkov in isolated venv | `bash scripts\u002Finstall_checkov.sh install` |\n\n## Reference Documentation\n\n**MUST READ during validation workflow:**\n\n| Reference | When to Read | Content |\n|-----------|--------------|---------|\n| `references\u002Fsecurity_checklist.md` | Before security scan | Security validation, Checkov\u002FTrivy usage, common policies, remediation patterns |\n| `references\u002Fbest_practices.md` | During validation | Project structure, naming conventions, module design, state management |\n| `references\u002Fcommon_errors.md` | When errors occur | Error database with causes and solutions |\n| `references\u002Fadvanced_features.md` | If Terraform >= 1.10 | Ephemeral values (1.10+), Actions (1.14+), List Resources (1.14+) |\n\n## Workflow Examples\n\n### Example 1: Validate Single File\n\n```\n1. MUST: bash scripts\u002Fextract_tf_info_wrapper.sh main.tf\n2. MUST: Context7 lookup for each provider detected\n3. MUST: Read references\u002Fsecurity_checklist.md\n4. MUST: Read references\u002Fbest_practices.md\n5. RUN: terraform fmt -check main.tf\n6. RUN: terraform init (if needed) && terraform validate\n7. MUST: bash scripts\u002Frun_checkov.sh -f json main.tf\n8. Report issues with remediation from references\n9. If custom providers: WebSearch for documentation\n```\n\n### Example 2: Full Module Validation\n\n```\n1. Identify all .tf files in directory\n2. MUST: bash scripts\u002Fextract_tf_info_wrapper.sh .\u002Fmodules\u002Fvpc\u002F\n3. MUST: Context7 lookup for ALL providers\n4. MUST: Read references\u002Fsecurity_checklist.md\n5. MUST: Read references\u002Fbest_practices.md\n6. RUN: terraform fmt -recursive\n7. RUN: tflint --recursive (or note as skipped if unavailable)\n8. RUN: terraform init && terraform validate\n9. MUST: bash scripts\u002Frun_checkov.sh .\u002Fmodules\u002Fvpc\u002F\n10. Analyze findings against security_checklist.md\n11. Validate structure against best_practices.md\n12. Provide comprehensive report with references\n```\n\n### Example 3: Production Dry-Run\n\n```\n1. Verify terraform initialized\n2. MUST: Read references\u002Fsecurity_checklist.md (production focus)\n3. RUN: terraform plan -var-file=\"production.tfvars\"\n4. Analyze for unexpected changes\n5. Highlight create\u002Fmodify\u002Fdestroy operations\n6. Flag security concerns (compare with security_checklist.md)\n7. Recommend whether safe to apply\n```\n\n## Advanced Features\n\nTerraform 1.10+ introduces ephemeral values for secure secrets management. Terraform 1.14+ adds Actions for imperative operations and List Resources for querying infrastructure.\n\n**MUST READ:** `references\u002Fadvanced_features.md` when:\n- Terraform version >= 1.10 is detected\n- Configuration uses `ephemeral` blocks\n- Configuration uses `action` blocks\n- Configuration uses `.tfquery.hcl` files\n\n## Integration with Other Skills\n\n- **k8s-yaml-validator** - For Terraform Kubernetes provider validation\n- **helm-validator** - When Terraform manages Helm releases\n- **k8s-debug** - For debugging infrastructure provisioned by Terraform\n\n## Notes\n\n- Always run validation in order: extract info → lookup docs → read refs → format → lint → validate → security → plan\n- MUST use wrapper scripts for extract_tf_info and checkov\n- MUST run `bash tests\u002Ftest_regression.sh` after script changes\n- MUST run lightweight CI checks: `bash -n scripts\u002F*.sh` and `python3 -m py_compile scripts\u002F*.py`\n- MUST read reference files before relevant validation steps\n- MUST lookup provider docs via Context7 for ALL providers\n- MUST offer recovery\u002Frerun when tools are missing\n- Never commit without running terraform fmt\n- Always review plan output before applying\n- Use version constraints for all providers and modules\n- Use remote state for team collaboration\n- Enable state locking to prevent concurrent modifications\n\n## Done Criteria\n\n- Validation instructions are executable end-to-end with one deterministic command path.\n- Wrapper scripts behave predictably in both success and failure paths (including propagated non-zero exits).\n- Regression tests cover parser error handling, implicit provider detection, wrapper argument handling, and checkov exit-code behavior.\n- Lightweight CI checks (`bash -n`, `py_compile`, smoke checks) pass before final reporting.\n","# Terraform Validator\n\nComprehensive toolkit for validating, linting, and testing Terraform configurations with automated workflows for syntax validation, security scanning, and intelligent documentation lookup.\n\n## ⚠️ Critical Requirements Checklist\n\n**STOP: You MUST complete these steps in order. Do NOT skip any REQUIRED step.**\n\n| Step | Action | Required |\n|------|--------|----------|\n| 1 | Run `bash scripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>` | ✅ REQUIRED |\n| 2 | Context7 lookup for **ALL** providers (explicit AND implicit); **WebSearch fallback if not found** | ✅ REQUIRED |\n| 3 | **READ** `references\u002Fsecurity_checklist.md` | ✅ REQUIRED |\n| 4 | **READ** `references\u002Fbest_practices.md` | ✅ REQUIRED |\n| 5 | Run `terraform fmt` | ✅ REQUIRED |\n| 6 | Run `tflint` (or note as skipped if unavailable) | Recommended |\n| 7 | Run `terraform init` (if not initialized) | ✅ REQUIRED |\n| 8 | Run `terraform validate` | ✅ REQUIRED |\n| 9 | Run `bash scripts\u002Frun_checkov.sh \u003Cpath>` | ✅ REQUIRED |\n| 10 | Cross-reference findings with `security_checklist.md` sections | ✅ REQUIRED |\n| 11 | Generate report citing reference files | ✅ REQUIRED |\n| 12 | Run regression tests (`bash tests\u002Ftest_regression.sh`) | ✅ REQUIRED |\n| 13 | Run lightweight CI checks (`bash -n`, `py_compile`, smoke) | ✅ REQUIRED |\n\n> **IMPORTANT:** Steps 3-4 (reading reference files) must be completed BEFORE running security scans. The reference files contain remediation patterns that MUST be cited in your report.\n\n> **Context7 Fallback:** If Context7 does not have a provider (common for: random, null, local, time, tls), use WebSearch: `\"terraform-provider-{name} hashicorp documentation\"`\n\n## When to Use This Skill\n\n- Working with Terraform files (`.tf`, `.tfvars`, `.tfstate`)\n- Validating Terraform configuration syntax and structure\n- Linting and formatting HCL code\n- Performing dry-run testing with `terraform plan`\n- Debugging Terraform errors or misconfigurations\n- Understanding custom Terraform providers or modules\n- Security validation of Terraform configurations\n\n## External Documentation\n\n| Tool | Documentation |\n|------|---------------|\n| **Terraform** | [developer.hashicorp.com\u002Fterraform](https:\u002F\u002Fdeveloper.hashicorp.com\u002Fterraform\u002Fdocs) |\n| **TFLint** | [github.com\u002Fterraform-linters\u002Ftflint](https:\u002F\u002Fgithub.com\u002Fterraform-linters\u002Ftflint) |\n| **Checkov** | [checkov.io](https:\u002F\u002Fwww.checkov.io\u002F1.Welcome\u002FQuick%20Start.html) |\n| **Trivy** | [aquasecurity.github.io\u002Ftrivy](https:\u002F\u002Faquasecurity.github.io\u002Ftrivy) |\n\n## Validation Workflow\n\n**IMPORTANT:** Follow this workflow in order. Each step is REQUIRED unless explicitly marked optional.\n\n```\n1. Identify Terraform files in scope\n   ├─> Single file, directory, or multi-environment\n\n2. Extract Provider\u002FModule Info (REQUIRED)\n   ├─> MUST run: bash scripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>\n   ├─> Parse output for providers and modules\n   └─> Use for Context7 documentation lookup\n\n3. Lookup Provider Documentation (REQUIRED)\n   ├─> For EACH provider detected:\n   │   ├─> mcp__context7__resolve-library-id with \"terraform-provider-{name}\"\n   │   ├─> mcp__context7__query-docs for version-specific guidance\n   │   └─> If NOT found in Context7: WebSearch fallback (see below)\n   └─> Note any custom\u002Fprivate providers for WebSearch\n\n4. Read Reference Files (REQUIRED before validation)\n   ├─> MUST READ: references\u002Fsecurity_checklist.md (before security scan)\n   ├─> MUST READ: references\u002Fbest_practices.md (for structure validation)\n   └─> Reference common_errors.md if errors occur\n\n5. Format and Lint (REQUIRED)\n   ├─> MUST run: terraform fmt -recursive (auto-fix formatting)\n   ├─> MUST run: terraform fmt -check -recursive (verify no drift)\n   ├─> RUN: tflint (or note as skipped if unavailable)\n   └─> Report formatting issues\n\n6. Syntax Validation (REQUIRED)\n   ├─> MUST run: terraform init (if not initialized)\n   ├─> MUST run: terraform validate\n   └─> Report syntax errors (consult common_errors.md)\n\n7. Security Scanning (REQUIRED)\n   ├─> MUST run: bash scripts\u002Frun_checkov.sh \u003Cpath>\n   ├─> Analyze policy violations against security_checklist.md\n   └─> Suggest remediations from reference\n\n8. Dry-Run Testing (if credentials available)\n   ├─> terraform plan\n   ├─> Analyze planned changes\n   └─> Report potential issues\n\n9. Regression and Wrapper Determinism Checks (REQUIRED)\n   ├─> MUST run: bash tests\u002Ftest_regression.sh\n   ├─> Confirms parser error handling returns non-zero\n   ├─> Confirms implicit provider detection for docs lookup\n   ├─> Confirms wrapper argument handling is deterministic\n   └─> Confirms checkov wrapper preserves scanner exit code\n\n10. Lightweight CI Checks (REQUIRED)\n   ├─> MUST run: bash -n scripts\u002F*.sh\n   ├─> MUST run: python3 -m py_compile scripts\u002F*.py\n   ├─> MUST run: smoke check for extract wrapper on sample fixture\n   └─> Record command outputs and exit codes\n\n11. Generate Comprehensive Report\n   ├─> Include all findings with severity\n   ├─> Reference best_practices.md for recommendations\n   └─> Offer to fix issues if appropriate\n```\n\n## Required Reference File Reading\n\n**You MUST read these reference files during validation:**\n\n| When | Reference File | Action |\n|------|----------------|--------|\n| **Before security scan** | `references\u002Fsecurity_checklist.md` | Read to understand security checks and remediation patterns |\n| **During validation** | `references\u002Fbest_practices.md` | Read to validate project structure, naming, and patterns |\n| **If errors occur** | `references\u002Fcommon_errors.md` | Read to find solutions for specific error messages |\n| **If using Terraform 1.10+** | `references\u002Fadvanced_features.md` | Read to understand ephemeral values, actions, list resources |\n\n## Required Script Usage\n\n**You MUST use these wrapper scripts instead of calling tools directly:**\n\n| Task | Script | Command |\n|------|--------|---------|\n| **Extract provider\u002Fmodule info** | `extract_tf_info_wrapper.sh` | `bash scripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>` |\n| **Run security scan** | `run_checkov.sh` | `bash scripts\u002Frun_checkov.sh \u003Cpath>` |\n| **Install checkov (if missing)** | `install_checkov.sh` | `bash scripts\u002Finstall_checkov.sh install` |\n\n> **Note:** `extract_tf_info_wrapper.sh` automatically handles the python-hcl2 dependency. If system Python lacks `python-hcl2`, it creates\u002Freuses a cached virtual environment under `~\u002F.cache\u002Fterraform-validator\u002F` by default.\n\n### Script Run Context (REQUIRED)\n\n- Default working directory: `devops-skills-plugin\u002Fskills\u002Fterraform-validator`\n- If running from elsewhere, use absolute script paths:\n  - `bash \u002Fabsolute\u002Fpath\u002Fto\u002Fterraform-validator\u002Fscripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>`\n  - `bash \u002Fabsolute\u002Fpath\u002Fto\u002Fterraform-validator\u002Fscripts\u002Frun_checkov.sh \u003Cpath>`\n  - `bash \u002Fabsolute\u002Fpath\u002Fto\u002Fterraform-validator\u002Fscripts\u002Finstall_checkov.sh install`\n\n## Context7 Provider Documentation Lookup (REQUIRED)\n\n**For EVERY provider detected, you MUST lookup documentation via Context7:**\n\n```\n1. Run extract_tf_info_wrapper.sh to get provider list\n2. For each provider (e.g., \"aws\", \"google\", \"azurerm\"):\n   a. Call: mcp__context7__resolve-library-id with \"terraform-provider-{name}\"\n   b. Call: mcp__context7__query-docs with the resolved ID\n   c. Note version-specific features and constraints\n3. Include relevant provider guidance in validation report\n```\n\n**Example for AWS provider:**\n```\nmcp__context7__resolve-library-id(\"terraform-provider-aws\")\nmcp__context7__query-docs(context7CompatibleLibraryID, \"best practices\")\n```\n\n### Context7 Fallback to WebSearch (REQUIRED)\n\n**If Context7 does not find a provider, you MUST fall back to WebSearch:**\n\n```\n1. If mcp__context7__resolve-library-id returns no results or provider not found:\n   a. Use WebSearch with query: \"terraform-provider-{name} hashicorp documentation\"\n   b. For specific version: \"terraform-provider-{name} {version} documentation site:registry.terraform.io\"\n2. Common providers NOT in Context7 (use WebSearch directly):\n   - random (hashicorp\u002Frandom)\n   - null (hashicorp\u002Fnull)\n   - local (hashicorp\u002Flocal)\n   - time (hashicorp\u002Ftime)\n   - tls (hashicorp\u002Ftls)\n3. Document in report: \"Provider docs via WebSearch (not in Context7)\"\n```\n\n**WebSearch Fallback Example:**\n```\n# If Context7 fails for random provider:\nWebSearch(\"terraform-provider-random hashicorp documentation site:registry.terraform.io\")\n```\n\n> **Note:** HashiCorp utility providers (random, null, local, time, tls, archive, external, http) may not be indexed in Context7. Always fall back to WebSearch for these.\n\n## Detecting Implicit Providers (REQUIRED)\n\n**IMPORTANT:** Providers can be used without being declared in `required_providers`. You MUST detect ALL providers:\n\n### Detection Methods\n\n1. **Explicit Providers:** Listed in `required_providers` block (from extract_tf_info_wrapper.sh output)\n2. **Implicit Providers:** Inferred from resource type prefixes\n\n### Common Implicit Provider Patterns\n\n| Resource Type Prefix | Provider Name | Context7 Lookup |\n|---------------------|---------------|-----------------|\n| `random_*` | `random` | `terraform-provider-random` |\n| `null_*` | `null` | `terraform-provider-null` |\n| `local_*` | `local` | `terraform-provider-local` |\n| `tls_*` | `tls` | `terraform-provider-tls` |\n| `time_*` | `time` | `terraform-provider-time` |\n| `archive_*` | `archive` | `terraform-provider-archive` |\n| `http` (data source) | `http` | `terraform-provider-http` |\n| `external` (data source) | `external` | `terraform-provider-external` |\n\n### Workflow for Complete Provider Detection\n\n```\n1. Parse extract_tf_info_wrapper.sh output\n2. Get providers from \"providers\" array (explicit)\n3. Get resources from \"resources\" array\n4. For EACH resource type:\n   a. Extract prefix (e.g., \"random\" from \"random_id\")\n   b. Check if already in providers list\n   c. If NOT in providers: add as implicit provider\n5. Perform Context7 lookup for ALL providers (explicit + implicit)\n```\n\n### Example\n\nIf `extract_tf_info_wrapper.sh` returns:\n```json\n{\n  \"providers\": [{\"name\": \"aws\", ...}],\n  \"resources\": [\n    {\"type\": \"aws_instance\", ...},\n    {\"type\": \"random_id\", ...}\n  ]\n}\n```\n\nYou MUST lookup BOTH:\n- `terraform-provider-aws` (explicit)\n- `terraform-provider-random` (implicit - detected from `random_id` resource)\n\n## Quick Reference Commands\n\n### Format and Lint\n\n```bash\n# Check formatting (dry-run)\nterraform fmt -check -recursive .\n\n# Apply formatting\nterraform fmt -recursive .\n\n# Run tflint (requires .tflint.hcl config)\ntflint --init              # Install plugins\ntflint --recursive         # Lint all modules\ntflint --format compact    # Compact output\n```\n\n> **TFLint Configuration:** See [TFLint Ruleset documentation](https:\u002F\u002Fgithub.com\u002Fterraform-linters\u002Ftflint\u002Fblob\u002Fmaster\u002Fdocs\u002Fuser-guide\u002Fplugins.md) for plugin setup.\n\n### Validate Configuration\n\n```bash\n# Initialize (downloads providers and modules)\nterraform init\n\n# Validate syntax\nterraform validate\n\n# Validate with JSON output\nterraform validate -json\n```\n\n### Security Scanning\n\n**MUST use wrapper script:**\n```bash\n# Use the wrapper script (REQUIRED)\nbash scripts\u002Frun_checkov.sh .\u002Fterraform\n\n# With specific options\nbash scripts\u002Frun_checkov.sh -f json .\u002Fterraform\nbash scripts\u002Frun_checkov.sh --compact .\u002Fterraform\n```\n\n> **Detailed Security Scanning:** You MUST read `references\u002Fsecurity_checklist.md` before running security scans to understand the checks and remediation patterns.\n\n## Security Finding Cross-Reference (REQUIRED)\n\n**When reporting security findings, you MUST cite specific sections from `security_checklist.md`:**\n\n### Cross-Reference Mapping\n\n| Checkov Check Pattern | security_checklist.md Section |\n|-----------------------|------------------------------|\n| `CKV_AWS_24` (SSH open) | \"Overly Permissive Security Groups\" |\n| `CKV_AWS_260` (HTTP open) | \"Overly Permissive Security Groups\" |\n| `CKV_AWS_16` (RDS encryption) | \"Encryption at Rest\" |\n| `CKV_AWS_17` (RDS public) | \"RDS Databases\" |\n| `CKV_AWS_130` (public subnet) | \"Network Security\" |\n| `CKV_AWS_53-56` (S3 public access) | \"Public S3 Buckets\" |\n| `CKV_AWS_*` (IAM) | \"IAM Security\" |\n| `CKV_AWS_79` (IMDSv1) | \"ECS\u002FEKS\" |\n| Hardcoded passwords | \"Hardcoded Credentials\" |\n| Sensitive outputs | \"Sensitive Output Exposure\" |\n\n### Report Template for Security Findings\n\n```markdown\n### Security Issue: [Check ID]\n\n**Finding:** [Description from checkov]\n**Resource:** [Resource name and file:line]\n**Severity:** [HIGH\u002FMEDIUM\u002FLOW]\n\n**Reference:** security_checklist.md - \"[Section Name]\"\n\n**Remediation Pattern:**\n[Copy relevant code example from security_checklist.md]\n\n**Recommended Fix:**\n[Specific fix for this configuration]\n```\n\n### Example Cross-Referenced Report\n\n````markdown\n### Security Issue: CKV_AWS_24\n\n**Finding:** Security group allows SSH from 0.0.0.0\u002F0\n**Resource:** aws_security_group.web (main.tf:47-79)\n**Severity:** HIGH\n\n**Reference:** security_checklist.md - \"Overly Permissive Security Groups\"\n\n**Remediation Pattern (from reference):**\n```hcl\nvariable \"admin_cidr\" {\n  description = \"CIDR block for admin access\"\n  type        = string\n}\n\nresource \"aws_security_group\" \"app\" {\n  ingress {\n    description = \"SSH from admin network only\"\n    from_port   = 22\n    to_port     = 22\n    protocol    = \"tcp\"\n    cidr_blocks = [var.admin_cidr]\n  }\n}\n```\n\n**Recommended Fix:** Replace `cidr_blocks = [\"0.0.0.0\u002F0\"]` with a variable or specific CIDR range.\n````\n\n### Dry-Run Testing\n\n```bash\n# Generate execution plan\nterraform plan\n\n# Save plan to file\nterraform plan -out=tfplan\n\n# Plan with specific var file\nterraform plan -var-file=\"production.tfvars\"\n\n# Plan with target resource\nterraform plan -target=aws_instance.example\n```\n\n**Plan Output Symbols:**\n- `+` Resources to be created\n- `-` Resources to be destroyed\n- `~` Resources to be modified\n- `-\u002F+` Resources to be replaced\n\n## Handling Missing Tools\n\nWhen validation tools are not installed, follow this recovery workflow:\n\n### Recovery Workflow (REQUIRED)\n\n```\n1. Detect missing tool\n2. Inform user what is missing and why it's needed\n3. Provide installation command\n4. ASK user: \"Would you like me to install [tool] and continue?\"\n5. If yes: Run installation and RERUN the validation step\n6. If no: Note as skipped in report, continue with available tools\n```\n\n### Tool-Specific Recovery\n\n**If checkov is missing:**\n```\n1. Inform: \"Checkov is not installed. It's required for security scanning.\"\n2. Ask: \"Would you like me to install it? I'll use: bash scripts\u002Finstall_checkov.sh install\"\n3. If yes: Run install script, then rerun security scan\n```\n\n**If tflint is missing:**\n```\n1. Inform: \"TFLint is not installed. It provides advanced linting beyond terraform validate.\"\n2. Ask: \"Would you like me to install it?\"\n3. Provide: brew install tflint (macOS) or installation script (Linux)\n```\n\n**If python-hcl2 is missing:**\n```\nThe extract_tf_info_wrapper.sh script handles this automatically by creating\nor reusing a cached venv. No user action required.\n```\n\n**Required tools:** `terraform fmt`, `terraform init`, `terraform validate`\n**Required for full security validation:** `checkov`\n**Optional but recommended:** `tflint`\n\n## Scripts\n\n| Script | Purpose | Usage |\n|--------|---------|-------|\n| `extract_tf_info_wrapper.sh` | Parse Terraform files for providers\u002Fmodules (auto-handles dependencies) | `bash scripts\u002Fextract_tf_info_wrapper.sh \u003Cpath>` |\n| `extract_tf_info.py` | Core parser (requires python-hcl2) | Use wrapper instead |\n| `run_checkov.sh` | Wrapper for Checkov scans with enhanced output | `bash scripts\u002Frun_checkov.sh \u003Cpath>` |\n| `install_checkov.sh` | Install Checkov in isolated venv | `bash scripts\u002Finstall_checkov.sh install` |\n\n## Reference Documentation\n\n**MUST READ during validation workflow:**\n\n| Reference | When to Read | Content |\n|-----------|--------------|---------|\n| `references\u002Fsecurity_checklist.md` | Before security scan | Security validation, Checkov\u002FTrivy usage, common policies, remediation patterns |\n| `references\u002Fbest_practices.md` | During validation | Project structure, naming conventions, module design, state management |\n| `references\u002Fcommon_errors.md` | When errors occur | Error database with causes and solutions |\n| `references\u002Fadvanced_features.md` | If Terraform >= 1.10 | Ephemeral values (1.10+), Actions (1.14+), List Resources (1.14+) |\n\n## Workflow Examples\n\n### Example 1: Validate Single File\n\n```\n1. MUST: bash scripts\u002Fextract_tf_info_wrapper.sh main.tf\n2. MUST: Context7 lookup for each provider detected\n3. MUST: Read references\u002Fsecurity_checklist.md\n4. MUST: Read references\u002Fbest_practices.md\n5. RUN: terraform fmt -check main.tf\n6. RUN: terraform init (if needed) && terraform validate\n7. MUST: bash scripts\u002Frun_checkov.sh -f json main.tf\n8. Report issues with remediation from references\n9. If custom providers: WebSearch for documentation\n```\n\n### Example 2: Full Module Validation\n\n```\n1. Identify all .tf files in directory\n2. MUST: bash scripts\u002Fextract_tf_info_wrapper.sh .\u002Fmodules\u002Fvpc\u002F\n3. MUST: Context7 lookup for ALL providers\n4. MUST: Read references\u002Fsecurity_checklist.md\n5. MUST: Read references\u002Fbest_practices.md\n6. RUN: terraform fmt -recursive\n7. RUN: tflint --recursive (or note as skipped if unavailable)\n8. RUN: terraform init && terraform validate\n9. MUST: bash scripts\u002Frun_checkov.sh .\u002Fmodules\u002Fvpc\u002F\n10. Analyze findings against security_checklist.md\n11. Validate structure against best_practices.md\n12. Provide comprehensive report with references\n```\n\n### Example 3: Production Dry-Run\n\n```\n1. Verify terraform initialized\n2. MUST: Read references\u002Fsecurity_checklist.md (production focus)\n3. RUN: terraform plan -var-file=\"production.tfvars\"\n4. Analyze for unexpected changes\n5. Highlight create\u002Fmodify\u002Fdestroy operations\n6. Flag security concerns (compare with security_checklist.md)\n7. Recommend whether safe to apply\n```\n\n## Advanced Features\n\nTerraform 1.10+ introduces ephemeral values for secure secrets management. Terraform 1.14+ adds Actions for imperative operations and List Resources for querying infrastructure.\n\n**MUST READ:** `references\u002Fadvanced_features.md` when:\n- Terraform version >= 1.10 is detected\n- Configuration uses `ephemeral` blocks\n- Configuration uses `action` blocks\n- Configuration uses `.tfquery.hcl` files\n\n## Integration with Other Skills\n\n- **k8s-yaml-validator** - For Terraform Kubernetes provider validation\n- **helm-validator** - When Terraform manages Helm releases\n- **k8s-debug** - For debugging infrastructure provisioned by Terraform\n\n## Notes\n\n- Always run validation in order: extract info → lookup docs → read refs → format → lint → validate → security → plan\n- MUST use wrapper scripts for extract_tf_info and checkov\n- MUST run `bash tests\u002Ftest_regression.sh` after script changes\n- MUST run lightweight CI checks: `bash -n scripts\u002F*.sh` and `python3 -m py_compile scripts\u002F*.py`\n- MUST read reference files before relevant validation steps\n- MUST lookup provider docs via Context7 for ALL providers\n- MUST offer recovery\u002Frerun when tools are missing\n- Never commit without running terraform fmt\n- Always review plan output before applying\n- Use version constraints for all providers and modules\n- Use remote state for team collaboration\n- Enable state locking to prevent concurrent modifications\n\n## Done Criteria\n\n- Validation instructions are executable end-to-end with one deterministic command path.\n- Wrapper scripts behave predictably in both success and failure paths (including propagated non-zero exits).\n- Regression tests cover parser error handling, implicit provider detection, wrapper argument handling, and checkov exit-code behavior.\n- Lightweight CI checks (`bash -n`, `py_compile`, smoke checks) pass before final reporting.\n",{"name":5,"description":7},"master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fdevops\u002Fterraform-validator",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill terraform-validator",{"tool":49,"command":50},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill terraform-validator",{"tool":52,"command":53},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill terraform-validator","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002FSKILL.md",true,[57,63,69,73,77,81,87,91,95,99,103,107],{"path":58,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":62},".gitignore","OTHER","其他",19,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002F.gitignore",{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"references\u002Fadvanced_features.md","REFERENCE","参考文档",10896,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Freferences\u002Fadvanced_features.md",{"path":70,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":71,"sourceHtmlUrl":72},"references\u002Fbest_practices.md",18066,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Freferences\u002Fbest_practices.md",{"path":74,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":75,"sourceHtmlUrl":76},"references\u002Fcommon_errors.md",12235,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Freferences\u002Fcommon_errors.md",{"path":78,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Fsecurity_checklist.md",16411,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Freferences\u002Fsecurity_checklist.md",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"scripts\u002Fextract_tf_info_wrapper.sh","SCRIPT","脚本",1742,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Fscripts\u002Fextract_tf_info_wrapper.sh",{"path":88,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":89,"sourceHtmlUrl":90},"scripts\u002Fextract_tf_info.py",24845,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Fscripts\u002Fextract_tf_info.py",{"path":92,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":93,"sourceHtmlUrl":94},"scripts\u002Finstall_checkov.sh",11240,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Fscripts\u002Finstall_checkov.sh",{"path":96,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Frun_checkov.sh",7142,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Fscripts\u002Frun_checkov.sh",{"path":100,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":101,"sourceHtmlUrl":102},"tests\u002F.terraform.lock.hcl",2493,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Ftests\u002F.terraform.lock.hcl",{"path":104,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":105,"sourceHtmlUrl":106},"tests\u002Fsample.tf",1663,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Ftests\u002Fsample.tf",{"path":108,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":109,"sourceHtmlUrl":110},"tests\u002Ftest_regression.sh",7116,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-validator\u002Ftests\u002Ftest_regression.sh",[112,136,151,166,179,192],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":129,"publishedAt":31},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[118,121,124],{"categoryNo":119,"categoryName":120,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":122,"categoryName":123,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[130,131,132,133,134,135],"writing skills","writing","use","editing","work","deployment",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":144,"publishedAt":31},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[142,143],{"categoryNo":122,"categoryName":123,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},[145,146,131,147,148,132,149,150],"plans","writing plans","requirements","task","code","spec",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":159,"publishedAt":31},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[157,158],{"categoryNo":122,"categoryName":123,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},[160,161,162,163,164,165,131],"docs:write concisely","write","docs","read","Rules","documentation",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":31},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[168,173,174,175,176,177,178],"why","kaizen","issue","five whys","analysis","root cause analysis",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":31},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[186,187,188,189,149,190,191],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":31},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[199,187,200,134,132,201,202,203],"verification before completion","commands","evidence","claim","complete"]