Skills Explorer Add Skills

terraform-skill

An agent skill by daymade, from daymade/claude-code-skills. Tags: aws, deployment, devops, infrastructure, terraform.

What it does

Diagnoses and designs safe Terraform releases, provisioners, multi-environment isolation, and fresh-host bootstrap. Use when writing or reviewing plan/apply wrappers, null_resource, remote-exec, local-exec, file provisioners, cloud-init, Docker Compose or Caddy deployment; when staging and production configuration may differ; when an IaC rollout can mutate a shared gateway; or when debugging drift, saved-plan, provenance, TLS, Restarting/unhealthy containers, DNS duplication, snapshot contamination, and post-apply failures. It emphasizes exact reviewed artifacts, pre-mutation validation, explicit production authorization, and independent live readback.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill terraform-skill

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/terraform-skill ~/.claude/skills/terraform-skill

Safety box score

Grade D, elevated risk: 49 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a Terraform release/runbook package: it tells an agent how to validate, apply, recover, and promote live infrastructure changes, including shared gateways and provisioners. The main risks are broad live mutation, exposure of secret-bearing state/env files, and host-level writes or privilege-requiring bootstrap steps.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution1 (low)It ships one executable test script (`tests/check-compose-precedence.sh`) and many shell snippets, but no opaque code loader or self-downloading installer.
Network access2 (moderate)It contacts remote services such as Cloudflare (`curl -fsS https://api.cloudflare.com/client/v4/user/tokens/verify`) and describes network-backed Terraform/cloud-init release flows.
Filesystem reach2 (moderate)The runbook writes outside the repo into live paths like `/data/...` and `/etc/caddy/Caddyfile`, and it discusses overwrite/delete behavior such as `rsync --delete` and state-file promotion.
Secrets & credentials2 (moderate)It explicitly handles `.env` files, Terraform state, and `CLOUDFLARE_API_TOKEN`; the docs also warn that pulled state copies "hold the full state, secrets included".
Privilege & persistence2 (moderate)It includes OS-level changes and installs (`apt-get install -y iptables-persistent`, service setup, SSH hardening, `chown`, mount/fstab work), which require elevated control of the host.
Instruction hijack surface0 (none)There are no hidden payloads, encoded instructions, or directives to ignore higher-priority rules; the approval language is about release gating, not prompt injection.
Irreversible actions3 (high)This skill is inherently about live deployment and recovery actions (`terraform apply`, saved-plan promotion, `terraform state push`, `docker compose up`), so it can mutate production systems and shared services.
Transparency0 (none)All shipped content is plain markdown plus a readable shell script; there are no binaries, base64 blobs, or unpinned remote code fetches in the skill files.

Before installing

Rated 2026-10-19 by an automated review of 6 files from the skill's repository.

Source

Repository
daymade/claude-code-skills (all skills from this repository)
Path
terraform-skill/SKILL.md
Branch
main
Updated
2026-09-20