[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C7WMSHMF1YB212DBGKHVB":3,"skill-same:01M71C7WMSHMF1YB212DBGKHVB":63},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":14,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":6,"ownerDescription":41,"updatedAt":42,"install":43,"resources":56},"01M71C7WMSHMF1YB212DBGKHVB","cloud-infrastructure-terraform",null,"Cloud Infrastructure Terraform.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-infrastructure-terraform\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30],"infrastructure","terraform","cloud","infrastructure terraform","cloud infrastructure","cloud infrastructure terraform","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cloud-infrastructure-terraform\ndescription: \"Cloud Infrastructure Terraform.\"\ndomain: cybersecurity\n---\n\n|\n| Infrastructure as Code | Practice of managing cloud infrastructure through declarative configuration files (Terraform, CloudFormation) rather than manual console operations |\n| Policy as Code | Expressing security and compliance policies as executable code (Rego, Python) that can be automatically evaluated against infrastructure definitions |\n| Shift Left Security | Moving security checks earlier in the development lifecycle by scanning IaC before deployment rather than auditing after provisioning |\n| Terraform Plan | Preview of changes Terraform will make, which can be exported as JSON for security scanning before applying changes |\n| Checkov | Open-source static analysis tool for IaC supporting Terraform, CloudFormation, Kubernetes, and Docker with 1000+ built-in policies |\n| OPA\u002FRego | Open Policy Agent and its policy language Rego for defining custom security rules that evaluate against structured data inputs |\n\n## Tools & Systems\n\n- **Checkov**: Comprehensive IaC scanner with 1000+ policies for Terraform, CloudFormation, Kubernetes, ARM, and Dockerfile\n- **tfsec**: Terraform-specific static analysis tool with detailed remediation guidance and SARIF output\n- **Terrascan**: Multi-IaC scanner supporting compliance frameworks (CIS, NIST, SOC 2) with policy-as-code\n- **OPA\u002FConftest**: Custom policy engine for defining organization-specific security rules using Rego language\n- **Bridgecrew**: Commercial platform built on Checkov providing drift detection and supply chain security\n\n## Common Scenarios\n\n### Scenario: Adding Security Gates to an Existing Terraform CI\u002FCD Pipeline\n\n**Context**: A DevOps team deploys infrastructure via Terraform in GitHub Actions but has no security scanning. Recent audit findings show multiple S3 buckets without encryption and security groups allowing SSH from the internet.\n\n**Approach**:\n1. Add Checkov as the first security gate in the GitHub Actions workflow\n2. Run `checkov -d .\u002Fterraform\u002F` to establish the current baseline of findings\n3. Triage existing findings: fix CRITICAL issues, create tickets for HIGH, suppress accepted risks\n4. Add tfsec as a secondary scanner for Terraform-specific checks\n5. Write custom OPA policies for organization standards (required tags, naming conventions)\n6. Configure the pipeline to block PRs with CRITICAL or HIGH findings\n7. Generate SARIF reports for GitHub Security tab integration\n\n**Pitfalls**: Adding security scanning to an existing project will initially produce hundreds of findings. Implement gradually by starting with CRITICAL-only blocking, then expanding to HIGH. Use inline suppression comments (`#checkov:skip=CKV_AWS_18:Public bucket for static website`) for intentional exceptions with documented justification.\n\n## Output Format\n\n```\nTerraform Security Audit Report\n==================================\nRepository: acme-corp\u002Finfrastructure\nBranch: main\nScan Date: 2026-02-23\nTools: Checkov 3.x, tfsec 1.x, OPA custom policies\n\nSCAN RESULTS:\n  Checkov checks passed:    187\n  Checkov checks failed:     34\n  tfsec checks passed:      156\n  tfsec checks failed:       28\n  OPA custom policies:       12 passed, 3 failed\n\nCRITICAL FINDINGS:\n[TF-001] S3 Bucket Without Encryption\n  File: modules\u002Fstorage\u002Fmain.tf:24\n  Resource: aws_s3_bucket.data_lake\n  Check: CKV_AWS_19\n  Fix: Add server_side_encryption_configuration block\n\n[TF-002] Security Group Allows SSH from 0.0.0.0\u002F0\n  File: modules\u002Fnetwork\u002Fsecurity.tf:45\n  Resource: aws_security_group_rule.ssh_access\n  Check: CKV_AWS_24\n  Fix: Restrict cidr_blocks to bastion subnet\n\n[TF-003] IAM Policy with Wildcard Actions\n  File: modules\u002Fiam\u002Fpolicies.tf:12\n  Resource: aws_iam_policy.developer_policy\n  Check: CKV_AWS_1\n  Fix: Scope actions to specific services required\n\nSUMMARY BY SEVERITY:\n  Critical:  6 findings\n  High:     14 findings\n  Medium:   28 findings\n  Low:      18 findings\n  Info:     12 findings\n```\n","|\n| Infrastructure as Code | Practice of managing cloud infrastructure through declarative configuration files (Terraform, CloudFormation) rather than manual console operations |\n| Policy as Code | Expressing security and compliance policies as executable code (Rego, Python) that can be automatically evaluated against infrastructure definitions |\n| Shift Left Security | Moving security checks earlier in the development lifecycle by scanning IaC before deployment rather than auditing after provisioning |\n| Terraform Plan | Preview of changes Terraform will make, which can be exported as JSON for security scanning before applying changes |\n| Checkov | Open-source static analysis tool for IaC supporting Terraform, CloudFormation, Kubernetes, and Docker with 1000+ built-in policies |\n| OPA\u002FRego | Open Policy Agent and its policy language Rego for defining custom security rules that evaluate against structured data inputs |\n\n## Tools & Systems\n\n- **Checkov**: Comprehensive IaC scanner with 1000+ policies for Terraform, CloudFormation, Kubernetes, ARM, and Dockerfile\n- **tfsec**: Terraform-specific static analysis tool with detailed remediation guidance and SARIF output\n- **Terrascan**: Multi-IaC scanner supporting compliance frameworks (CIS, NIST, SOC 2) with policy-as-code\n- **OPA\u002FConftest**: Custom policy engine for defining organization-specific security rules using Rego language\n- **Bridgecrew**: Commercial platform built on Checkov providing drift detection and supply chain security\n\n## Common Scenarios\n\n### Scenario: Adding Security Gates to an Existing Terraform CI\u002FCD Pipeline\n\n**Context**: A DevOps team deploys infrastructure via Terraform in GitHub Actions but has no security scanning. Recent audit findings show multiple S3 buckets without encryption and security groups allowing SSH from the internet.\n\n**Approach**:\n1. Add Checkov as the first security gate in the GitHub Actions workflow\n2. Run `checkov -d .\u002Fterraform\u002F` to establish the current baseline of findings\n3. Triage existing findings: fix CRITICAL issues, create tickets for HIGH, suppress accepted risks\n4. Add tfsec as a secondary scanner for Terraform-specific checks\n5. Write custom OPA policies for organization standards (required tags, naming conventions)\n6. Configure the pipeline to block PRs with CRITICAL or HIGH findings\n7. Generate SARIF reports for GitHub Security tab integration\n\n**Pitfalls**: Adding security scanning to an existing project will initially produce hundreds of findings. Implement gradually by starting with CRITICAL-only blocking, then expanding to HIGH. Use inline suppression comments (`#checkov:skip=CKV_AWS_18:Public bucket for static website`) for intentional exceptions with documented justification.\n\n## Output Format\n\n```\nTerraform Security Audit Report\n==================================\nRepository: acme-corp\u002Finfrastructure\nBranch: main\nScan Date: 2026-02-23\nTools: Checkov 3.x, tfsec 1.x, OPA custom policies\n\nSCAN RESULTS:\n  Checkov checks passed:    187\n  Checkov checks failed:     34\n  tfsec checks passed:      156\n  tfsec checks failed:       28\n  OPA custom policies:       12 passed, 3 failed\n\nCRITICAL FINDINGS:\n[TF-001] S3 Bucket Without Encryption\n  File: modules\u002Fstorage\u002Fmain.tf:24\n  Resource: aws_s3_bucket.data_lake\n  Check: CKV_AWS_19\n  Fix: Add server_side_encryption_configuration block\n\n[TF-002] Security Group Allows SSH from 0.0.0.0\u002F0\n  File: modules\u002Fnetwork\u002Fsecurity.tf:45\n  Resource: aws_security_group_rule.ssh_access\n  Check: CKV_AWS_24\n  Fix: Restrict cidr_blocks to bastion subnet\n\n[TF-003] IAM Policy with Wildcard Actions\n  File: modules\u002Fiam\u002Fpolicies.tf:12\n  Resource: aws_iam_policy.developer_policy\n  Check: CKV_AWS_1\n  Fix: Scope actions to specific services required\n\nSUMMARY BY SEVERITY:\n  Critical:  6 findings\n  High:     14 findings\n  Medium:   28 findings\n  Low:      18 findings\n  Info:     12 findings\n```\n",{"name":5,"domain":30,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud-infrastructure-terraform","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill cloud-infrastructure-terraform",{"tool":49,"command":50},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill cloud-infrastructure-terraform",{"tool":52,"command":53},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill cloud-infrastructure-terraform","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-infrastructure-terraform\u002FSKILL.md",true,[57],{"path":58,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":62},"index.json","REFERENCE","参考文档",520,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud-infrastructure-terraform\u002Findex.json",[64,89,112,134,156,172],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":31},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,30,88],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":31},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[96,71,97,74,98,99,100,30,101,102,103,104,105,106,76,107,108,109,110,111],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":31},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[119,120,121,122,123,124,30,101,125,102,126,127,76,109,128,129,130,131,132,133],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":31},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[72,141,142,143,144,145,146,77,147,30,88,148,149,150,151,152,153,154,155,76],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":31},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[163,164,72,165,143,145,166,77,167,147,30,88,102,168,169,170,171,155,76,78],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":31},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[179,72,143,180,166,77,181,182,30,88,183,184,185,186,187,188,76,78,189,190],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]