Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
*.tf / *.tofu for misconfigurations.sast-scan.container-scan.Follows skills/_lib/contract.md. In short: use the vulnetix_* MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes.
Read .vulnetix/capabilities.yaml. Confirm derived.has_iac: true or --paths provided. Otherwise abort.
vulnetix iac --paths "$PATHS" -o json > .vulnetix/iac.${TIMESTAMP}.json
Captures: open security groups, missing encryption, public S3/GCS, IAM wildcards, unpinned providers, secrets in plaintext, missing tags, unencrypted state backends.
| Severity | File:Line | Resource | Issue | Recommendation |
Group by file. For each high-severity issue, include a 2-3 line code example of the fix.
If binaries.terraform: true (or tofu), suggest:
terraform plan -no-color | head -200 # for context on what would change
Don't run terraform apply from the skill.
.vulnetix/iac/<timestamp>.summary.yaml with finding counts.
derived.has_iac: true OR explicit --paths. CWD without *.tf files = empty result.var.environment == "prod" conditional logic is reported as both branches.terraform plan integration is suggestive only — the skill does NOT run terraform plan automatically (state access concerns).terraform import candidates) is not detected.*.yaml files with kind: matching common workload types.No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs.
The English summary is being prepared. Showing the original description.
Show what this repository has already decided about its vulnerabilities, read from the durable record rather than by scanning again — open versus resolved, the decision taken on each, and what is still waiting. Use when picking up triage after a break, auditing past decisions, onboarding to a repository with security history, or checking nothing high-severity is open before a release.
The English summary is being prepared. Showing the original description.
Dependency-conflict resolution when a `fix` version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (`overrides`/`resolutions`/`replace`/`[patch]`), fall back to safe-harbour inline patching. Use when an upgrade is blocked by transitive constraints, a peer-dep conflict surfaces, or you need to override a vulnerable transitive without bumping the parent.
The English summary is being prepared. Showing the original description.
Work through which package to add for a capability, and what each option costs — maintenance, licence, bundle weight, transitive risk, and whether the platform already does it. Use when someone needs a library for a job and has not picked one yet, when weighing two candidates, or when a package looks convenient but unmaintained.
The English summary is being prepared. Showing the original description.
IDS/IPS detection content for a CVE — Snort/Suricata-compatible rules, YARA signatures, ProjectDiscovery Nuclei templates, traffic-filter rules. Capability-aware: skips families when the binary is not installed (no Snort = no Snort output). Use when deploying defences for a CVE without a patch, augmenting SAST with active detection, or feeding the SOC engineering pipeline.
The English summary is being prepared. Showing the original description.
End-of-life detection for runtimes (Node, Python, Java, Go, .NET) and key packages — surfaces past-EOL items, items reaching EOL within 90 days, and EOL base images for containers. Use when planning a runtime upgrade, auditing for unsupported versions, gating a deploy against EOL deps, or producing a remediation roadmap.
The English summary is being prepared. Showing the original description.