terraform-skill
Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards.
Profile →npx skills add antonbabenko/terraform-skill --skill terraform-skill --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Diagnose-first guidance for Terraform and OpenTofu. Core file is a workflow; depth lives in references loaded on demand.
How it works
- The skill provides a response contract requiring explicit assumptions (runtime, exact version, providers, backend, execution path, environment criticality) and a risk category, remediation choices with tradeoffs, a tailored validation plan, and rollback notes.
- It enforces not running destructive actions like terraform destroy without a reviewed plan and explicit confirmation.
- It follows a stepwise workflow: capture execution context, diagnose failure modes via a routing table of categories, load only the matching reference files, propose fixes with guardrails, generate artifacts, validate, then emit the final response contract.
- It defines a set of failure categories (e.g., Identity churn, Secret exposure, Blast radius, CI drift, State corruption, Provider upgrade risk, Testing blind spots) and links each to relevant references.
- The skill outlines how to structure outputs and how to present the final remediation plan, validation, and rollback notes.
When to use it
Activate when creating or reviewing Terraform/OpenTofu configurations or modules, setting up or debugging tests, structuring multi-environment deployments, implementing IaC CI/CD, choosing module patterns or state organization, configuring or migrating remote state backends.
What it can touch
The skill mentions commands and references but does not list executable tools beyond the policy and workflow guidance; it requires runtime context and references to tailor actions. It specifies exact commands for safety and validation (e.g., terraform plan -destroy in context, with explicit user confirmation) within its guidance.
Caveats
License: Apache-2.0. It requires explicit confirmation before destructive actions and forbids applying without a reviewed plan artifact. It emphasizes emitting a formal Response Contract and loading only necessary references to diagnose issues.
# Terraform Skill for Claude Diagnose-first guidance for Terraform and OpenTofu. Core file is a workflow; depth lives in references loaded on demand. ## Response Contract Every Terraform/OpenTofu response must include: 1. **Assumptions & version floor** — runtime (`terraform` or `tofu`), exact version, providers, state backend, execution path (local/CI/Cloud/Atlantis), environment criticality. State assumptions explicitly if the user did not provide them. 2. **Risk category addressed** — one or more of: identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, provider upgrade risk, testing blind spots. 3. **Chosen remediation & tradeoffs** — what was chosen, what was traded off, why. 4. **Validation plan** — exact commands (`fmt -check`, `validate`, `plan -out`, policy check) tailored to runtime and risk tier. 5. **Rollback notes** — for any destructive or state-mutating change: how to undo, what evidence to keep. Never recommend direct production apply without a reviewed plan artifact and approval. Never run `terraform destroy` (targeted or full) without first running `terraform plan -destroy` and showing the user every resource that will be dele
- Response Contract
- Workflow
- Diagnose Before You Generate
- When to Use This Skill
- Core Principles
- Module Hierarchy
- Directory Layout
- Naming Conventions (summary)
- Block Ordering (summary)
- Testing Strategy
- Decision Matrix: Which Testing Approach?
- Native Test Rules (1.6+)
- Count vs ForEach — Quick Rule
- Locals for Dependency Management
trivy config . checkov -d .
What does the terraform-skill skill do?
Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards.
How do I install it?
Run `npx skills add antonbabenko/terraform-skill --skill terraform-skill --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From antonbabenko/terraform-skill, a repository with 2,238 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.