checkov
Skill71 starsChanged 8 days agoApache-2.0View on GitHub
Bootstrap Checkov on a developer laptop, run static or plan-level Terraform security scanning for AWS/Azure/GCP/EKS, resolve private GitHub modules with a GITHUB_PAT you export, generate pre-commit hooks, produce multi-format output (cli/json/sarif/junit), and fix violations with AI-generated patches. Use when asked to "scan my Terraform", "run checkov", "check my IaC for security issues", "set up checkov pre-commit", or "fix checkov findings".
We split this skill into the rules it gives an agent
4 rules. About 0 are common, 2 are distinctive, and 2 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
2
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 12
Read references/checkov.md before responding.
- Distinctive: line 58
Before asking any question, classify the user's intent from their free-text request:
- Distinctive: line 73
Do not pepper the user with questions.
- Very specific: line 83
Never ask about: output format (default to cli), whether to run bootstrap (always do it), whether to gitignore output files (always do it), …
≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Bootstrap Checkov and scan Terraform code for security misconfigurations — locally, before CI catches them.
Read references/checkov.md before responding. It contains all mode logic, bootstrap steps, provider detection, and fix patterns.
Mode dispatch
Parse the first word of $ARGUMENTS as the mode. When $ARGUMENTS is empty, run the interactive wizard.
| Mode | What it does |
static | Scan .tf source files with --download-external-modules true |
plan | terraform init → plan → JSON → Checkov --deep-analysis (use --upgrade flag to also upgrade providers) |
secrets | Scan entire repo for hardcoded secrets (--framework secrets --enable-secret-scan-all-files) |
audit | One-time secrets history scan across all commits (--scan-secrets-history) |
multi | Scan Terraform + GitHub Actions + Dockerfiles + Helm in a single run |
baseline | Create .checkov.baseline to snapshot existing violations |
fix | Re-run scan and apply AI-generated patches to .tf files |
scaffold | Generate .checkov.yaml config (SOC 2 / CIS / PCI / HIPAA variants) and/or custom-checks/ |
| (empty) | Interactive wizard — ask Q1 (mode) then Q2 (path/context) |
Interactive Wizard
Q1 — Mode?
What do you need?
1. static — scan .tf source files [default]
2. plan — terraform plan → Checkov deep analysis
3. secrets — scan entire repo for hardcoded secrets and tokens
4. audit — one-time scan of git commit history for leaked secrets
5. multi — scan Terraform + GitHub Actions + Dockerfiles + Helm together
6. baseline — snapshot existing violations (first-run brownfield)
7. fix — scan and apply AI-generated fixes to .tf files
8. scaffold — generate .checkov.yaml (SOC 2 / CIS / PCI / HIPAA) or custom-checks/
Enter 1–8 or mode name:Q2 — Path? (ask after Q1)
Terraform root directory, or press Enter to scan current directory [default: .]:Then proceed into the relevant mode section in references/checkov.md.
Agent behavior
Intent classification
Before asking any question, classify the user's intent from their free-text request:
| Intent signals | Mode |
| "scan", "check", "lint", "review my Terraform", "check my IaC" | static |
| "plan", "deep analysis", "live values", "against real state" | plan |
| "secrets", "hardcoded", "leaked credentials", "tokens in code", "secret scan" | secrets |
| "git history", "scan history", "ever committed", "old commits", "audit history" | audit |
| "scan everything", "multi-framework", "github actions", "dockerfiles", "helm" | multi |
| "existing repo", "too many findings", "noisy", "brownfield", "baseline" | baseline |
| "fix", "remediate", "resolve", "CKV_*" | fix |
| "set up", "configure", "pre-commit", "custom checks", ".checkov.yaml", "scaffold" | scaffold |
Ask only for missing high-risk inputs
Do not pepper the user with questions. Only prompt for inputs where getting it wrong causes real harm:
| When to ask | Question |
| Multiple Terraform roots detected | "Which root? (1. terraform/aws/ 2. terraform/azure/ 3. All)" |
Plan mode, multiple *.tfvars found | "Which var file? (1. staging.tfvars 2. production.tfvars 3. None)" |
| Plan mode, non-default workspace detected | "Currently on workspace '<name>' — continue? (y/N)" |
| Fix → Apply mode | "Apply these changes? (y/N)" — show unified diff first |
| scaffold writes a new file | "Write .checkov.yaml to <path>? (y/N)" |
Never ask about: output format (default to cli), whether to run bootstrap (always do it), whether to gitignore output files (always do it), or pre-commit detection (always check silently).
Cross-references
/platform-skills:terraform— full validation pipeline (fmt → validate → tflint → checkov → plan)/platform-skills:compliance— SOC 2 control mapping and Checkov check IDs by TSC criterion/platform-skills:supply-chain— image signing, SBOM, and CVE scanning beyond IaC
In this repository59 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- .github/copilot-instructions.mdCopilot instructions
- .cursor/rules/keda.mdcCursor rule
- .cursor/rules/kubernetes.mdcCursor rule
- .cursor/rules/platform-skills.mdcCursor rule
- .cursor/rules/terraform.mdcCursor rule
- code-reviewSkill
- platform-skillsSkill
- ai-governanceSkill
- awesome-docsSkill
- aws-profileSkill
- awsSkill
- azureSkill
- backup-drSkill
- chaosSkill
- cluster-upgradeSkill
- commitSkill
- complianceSkill
- composite-actionsSkill
- datadogSkill
- debugSkill
- documentSkill
- doraSkill
- dynatraceSkill
- finopsSkill
- fluxcdSkill
- gateway-apiSkill
- github-actionsSkill
- gitopsSkill
- helmchartSkill
- karpenterSkill
- kedaSkill
- kingfisherSkill
- kubernetesSkill
- kubescape-operatorSkill
- kubescapeSkill
- kyvernoSkill
- linkerdSkill
- linuxSkill
- mcpSkill
- observabilitySkill
- opaSkill
- openshiftSkill
- platform-skillsSkill
- preflightSkill
- productSkill
- progressive-deliverySkill
- pr-reviewSkill
- renovateSkill
- runtime-securitySkill
- secretsSkill
- self-improveSkill
- setup-agentsSkill
- supply-chainSkill
- terraformSkill
- token-optimizerSkill
- triageSkill
- trivySkill
- zizmorSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.