iac-security-scan-skills
senaykt/iac-security-scan-skills
An AI-powered infrastructure-as-code security scanner that performs multi-pass assessments on Terraform and CloudFormation codebases. It detects privilege escalation, internet exposure, secret leaks, and multi-domain attack paths.
48 6MITUpdated 2026-05-30
83
GreatOverview
This multi-agent security tool orchestrates code analysis, domain-specific security assessments (IAM, network, storage, secrets, logging, serverless), and cross-domain attack chain correlation. It runs in structured steps, utilizing file routing and parallel subagents to generate comprehensive HTML, CSV, and terminal reports without requiring external API keys or heavy plugins.
Capabilities
- ▸Repository architecture mapping and file routing
- ▸Parallel multi-domain security evaluation
- ▸IAM privilege escalation and trust chain analysis
- ▸VPC topology and internet exposure identification
- ▸Cross-domain attack path correlation
- ▸Multi-format reporting (HTML, CSV, terminal table)
Best for
Conducting automated security reviews of Terraform and CloudFormation projects, Detecting complex, cross-domain attack paths in cloud infrastructure code, Auditing IAM policies and identifying privilege escalation risks, Scanning repositories for hardcoded credentials and secret leaks
Works with
Claude CodeCodexCursorOpenCode
Evoa Score breakdown= Σ (score × weight)
83Task usefulness20%100 → +20.0
実タスクにどれだけ役立つか（機能の豊富さ・用途の明確さ）。 — AIによるcapabilities/use-cases解析
Code quality15%90 → +13.5
実装・指示の品質。 — AIによるSKILL.md/README解析
Maintenance15%85 → +12.8
リポジトリがどれだけ活発に保守されているか。 — GitHub 最終push日時の新しさ
Documentation12%37 → +4.4
ドキュメントの充実度・分かりやすさ。 — README/独自要約の情報量
Security15%100 → +15.0
危険・不審な挙動が無いか。 — AIによるセキュリティレビュー
Originality10%85 → +8.5
ありふれたラッパーではない独自性。 — AIによる独自性判定
Popularity8%45 → +3.6
コミュニティの採用度。 — GitHub Stars/Forks（対数スケール）
Compatibility5%100 → +5.0
対応AIエージェントの広さ。 — AIによる対応エージェント判定
Weighted total82.8 / 100
ライセンス不明/制限あり（Red）のSkillは総合スコアに0.85倍の補正を適用します。 ランキングはこのScoreのみで決まり、広告で変わりません。 算出方法の詳細 →
Security considerations
Operates locally on provided infrastructure-as-code files to identify security configurations and misconfigurations. Ensure sensitive codebases are evaluated securely within your trusted local or IDE environment.
Categories
Summary and analysis are original content generated by AI Skills Rank. The skill's source text is not reproduced here — view it on the linked repository.