iac-misconfig-scan
Skill13 starsChanged 20 days agoApache-2.0View on GitHub
Scan infrastructure-as-code — Dockerfiles, Compose, Terraform, and GitHub Actions — for security misconfigurations like running as root, world-writable files, unpinned actions, and hardcoded secrets. Pure Claude Code, no signup.
In this repository35 other files it gives its agents.
- accessibility-checkSkill
- agentic-app-risk-reviewSkill
- api-security-scanSkill
- broken-link-scanSkill
- cold-load-waterfallSkill
- complexity-hotspotsSkill
- console-error-scanSkill
- cookie-privacy-scanSkill
- core-web-vitalsSkill
- dead-code-scanSkill
- dependency-auditSkill
- diff-risk-reviewSkill
- error-handling-auditSkill
- evidence-code-auditSkill
- exploited-vulnerability-watchSkill
- flaky-selector-scanSkill
- form-validation-scanSkill
- i18n-rtl-auditSkill
- invisible-inkSkill
- license-compliance-scanSkill
- mixed-content-scanSkill
- mr-nullSkill
- page-weight-budgetSkill
- railway-exposure-auditSkill
- responsive-screenshotsSkill
- script-quality-reviewSkill
- scunthorpe-checkSkill
- secret-scanSkill
- security-advisory-triageSkill
- security-auditSkill
- security-headers-checkSkill
- seo-checkSkill
- test-quality-reviewSkill
- third-party-bloatSkill
- ui-ux-scanSkill
The file
Files
IaC Misconfig Scan
Catch insecure infrastructure-as-code before it ships. Read-only: it flags misconfigurations with file:line, it doesn't change anything.
Prerequisites
- None. Pure Claude Code — reads IaC files directly, no MCP required.
Trigger
- "Scan my Dockerfile / Terraform / workflows for misconfigs"
- "Is my infrastructure-as-code secure?"
- "IaC security review"
Workflow
- Find IaC files:
Dockerfile,docker-compose*.yml,*.tf, and.github/workflows/*.yml. - Review each against the checks below; report
file:line, severity, and the fix.
Containers (Dockerfile / Compose)
| Misconfiguration | Why it's risky |
No USER / runs as root | Container compromise becomes host-level risk |
World-writable file modes (e.g. 0777) | Tampering and privilege issues |
:latest or unpinned base image | Non-reproducible, unreviewed updates |
| Download-and-execute build step (remote script piped into a shell) | Unverified remote code in the image |
Hardcoded secrets / credentials in ENV or ARG | Secret leakage in image layers |
privileged: true, host network, or host path mounts (Compose) | Container escape / host exposure |
ADD with a remote URL | Silent, unverified remote fetch (prefer COPY) |
Terraform
| Misconfiguration | Why it's risky |
Public object storage / open ingress (0.0.0.0/0) | Data exposure / open attack surface |
Hardcoded secrets in .tf or state | Credential leakage |
| Unencrypted storage / disabled logging | Data-at-rest and audit gaps |
GitHub Actions
| Misconfiguration | Why it's risky |
| Actions pinned to a tag, not a commit SHA | Supply-chain tampering |
Broad permissions (or none set) | Excess token scope |
Secrets echoed or used in pull_request_target with checkout of PR code | Secret exfiltration |
- Output a severity-ranked report:
## IaC Misconfig Scan
**1 high, 2 medium**
### HIGH
- Dockerfile:1 — base image uses ":latest"; pin to a digest for reproducible,
reviewable builds.
### MEDIUM
- .github/workflows/ci.yml:7 — action pinned to a tag, not a commit SHA.
- docker-compose.yml:12 — service runs without a non-root USER.Diagnostic only. Want IaC and SAST checks enforced on every PR? See QualityMax — qualitymax.io
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.