Review Infrastructure-as-Code (Terraform, CloudFormation, ARM/Bicep, Pulumi, Ansible, Helm) for security misconfigurations before deployment — public exposure, weak IAM, missing encryption, open networking, and hardcoded secrets. Use to shift-left and catch cloud/k8s misconfig at the code layer.
How this skill is triggered — by the user, by Claude, or both
Slash command
/infrastructure-security:iac-security-reviewThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
A triaged set of IaC security findings, each tied to the resource/line and a fix —
A triaged set of IaC security findings, each tied to the resource/line and a fix — so misconfigurations are caught before they reach a live environment.
reference.md for the checklist)0.0.0.0/0, public buckets/storage, public IPs on sensitive hosts).secrets-management-review).A findings table: file:line · resource · misconfig · severity · fix (corrected
snippet). Confirmed issues → security-reporting:finding. These map to the same
controls cloud-security / k8s-security check at runtime.
Shift-left: fixing in IaC prevents the misconfig everywhere it's deployed and stops drift. Treat secrets in code/state as high severity. Pin and vet third-party modules — they run with your deploy credentials.
Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub jassics/awesome-claude-security --plugin infrastructure-security