Terraform Module Linter

Lint Terraform modules and configurations (.tf files) for structure, naming, security, and best practices. 24 rules across structure, naming, security, and b...

Security Scan

The skill's code, instructions, and requirements are consistent with a Terraform linter — it reads .tf files in the specified path and reports issues; it does not request credentials, install external code, or perform network activity in the provided files.

Purpose & Capability

Name/description (Terraform module linter) matches what is included: an instruction document showing how to run the included Python script and a Python linter implementation. No unrelated binaries, env vars, or external services are required.

Instruction Scope

SKILL.md instructs running the bundled script against a user-provided path (file or directory). The script (as shown) reads only .tf files from the specified path, parses HCL-ish blocks with regex, and emits findings; it does not instruct reading arbitrary system config, credentials, or contacting remote endpoints.

Install Mechanism

No install specification is present — this is instruction-only plus a bundled Python script. Nothing is downloaded or written to disk by an installer. Risk from install mechanism is low.

Credentials

The skill requires no environment variables, credentials, or config paths. The code does not reference env vars or external credentials in the provided portion.

Persistence & Privilege

The skill is not always-enabled and does not request persistent privileges. It is user-invocable and can be run by the agent, which is expected for skills. No evidence it modifies other skills or system-wide settings.

Assessment

This skill appears coherent and limited to linting .tf files. Before using it: (1) Review the full script if you need to be 100% certain there is no network I/O in the truncated portion (the visible code performs only local file reads and regex parsing). (2) Expect the internal HCL parser to be simplistic — it may produce false positives or miss complex HCL constructs; test on non-production modules first. (3) The linter will read any files you point it at, so avoid running it on directories containing secrets unless you are comfortable exposing those file contents to the agent's outputs. If you want extra assurance, run the script locally in an isolated environment before granting the agent permission to invoke it.

Lint Terraform .tf files and modules for structure, naming conventions, security issues, and best practices.

Commands

# Lint a Terraform directory (all rules)
python3 scripts/terraform_module_linter.py lint path/to/module/

# Check security issues only
python3 scripts/terraform_module_linter.py security path/to/module/

# Check naming conventions
python3 scripts/terraform_module_linter.py naming path/to/module/

# Validate module structure
python3 scripts/terraform_module_linter.py validate path/to/module/

# Lint a single file
python3 scripts/terraform_module_linter.py lint path/to/main.tf

# JSON output
python3 scripts/terraform_module_linter.py lint path/to/module/ --format json

# Summary only
python3 scripts/terraform_module_linter.py lint path/to/module/ --format summary

Rules (24)

Structure (6)

• Missing main.tf, variables.tf, or outputs.tf
• Missing terraform block with required_version
• Missing required_providers block
• Empty variable/output blocks
• Unused variables (declared but not referenced)
• Missing variable descriptions

Naming (6)

• Resource names must be snake_case
• Variable names must be snake_case
• Output names must be snake_case
• Module names must be snake_case
• Local names must be snake_case
• Data source names must be snake_case

Security (6)

• Hardcoded credentials/secrets in values
• Overly permissive IAM policies (*)
• Missing encryption configuration
• Public access enabled (public_access, publicly_accessible)
• Hardcoded IP addresses (0.0.0.0/0)
• Sensitive variables without sensitive flag

Best Practices (6)

• Missing variable type constraints
• Missing variable default values
• Missing output descriptions
• Using deprecated resource attributes
• Missing lifecycle blocks for stateful resources
• Missing tags on taggable resources

Output Formats

• text (default): Human-readable with colors and severity icons
• json: Machine-readable with file, line, rule, severity, message
• summary: Counts by severity only

Exit Codes

• 0: No issues (or warnings only)
• 1: Errors found
• 2: Invalid input