Terraform & OpenTofu Infrastructure Skill
Helps AI coding agents test, structure, and deliver production-oriented Terraform and OpenTofu infrastructure code.
SKILL.md explicitly requires version/runtime context, risk categories, approval, reviewed plan artifacts, and rollback notes, and prohibits unconfirmed production apply/destroy; it also warns against storing secrets in state. Deducted 9 points because enforcement is not demonstrated, data-flow and permission boundaries are not fully specified, and recovery procedures remain high-level. The release workflow uses a RELEASE_TOKEN with contents/pull-requests write access and third-party Actions referenced by mutable tags. The LICENSE contains Apache 2.0 text, but metadata says NOASSERTION and publisher provenance is unverified, reducing attribution confidence.
The workflow is internally organized with diagnosis routing, version guards, validation commands, and abnormal-case guidance. However, the supplied evidence does not include the referenced reference files, a test suite, or execution results; key paths depend on external tools, MCP, Terraform/OpenTofu, and initialized workspaces. Deducted 12 points because static review cannot confirm reference completeness, command runnability, cross-version behavior, or failure-feedback quality.
Activation conditions, use cases, and non-fit cases are relatively clear, covering Terraform/OpenTofu, testing, modules, CI/CD, and state management with stated runtime ranges. Chinese-language support, semantic false-trigger boundaries, and practical compatibility across agent hosts lack evidence; installation and optional tooling depend on GitHub, npm, and other overseas resources. Deducted 5 points: the core guidance does not entirely depend on those services, but mainland-China reachability and localization are unverified.
SKILL.md uses a response contract, workflow, and progressive on-demand references; the README supplies installation instructions, examples, version information, Apache 2.0 licensing, contribution guidance, and an issue path, with an automated release workflow. Deducted 6 points because the referenced material was not supplied for review, maintenance responsibility and update paths remain largely external, license metadata conflicts with the file, the README contains a duplicated Kiro section, and no complete changelog or compatibility test evidence is shown.
The material directly addresses common Terraform/OpenTofu production tasks and supplies risk categories, decision matrices, commands, and reusable HCL patterns that should reduce common IaC errors. Deducted 9 points because no representative outputs, test results, or third-party execution evidence are included, and quality depends on the agent correctly loading references, identifying runtime details, and performing validation. Static evidence supports approximate core-task completion, not directly usable results.
The files provide version tables, commands, workflows, and a list of external sources, creating some auditability. Deducted 6 points because no visible key-path test suite, CI results, execution logs, or independent corroboration are supplied. The assessment therefore relies mainly on author documentation and claims; static reading cannot independently reproduce behavior, and the cited depth files are absent from the supplied evidence.
- This is a static-only review; Terraform, OpenTofu, tests, scanners, MCP, and CI workflows were not executed.
- Before use, confirm that all referenced files are present in the pinned revision and verify Terraform/OpenTofu and provider compatibility.
- Production changes still require human review of the plan artifact, explicit approval, and recoverable backups; marking a value sensitive does not remove it from state.
- The release workflow requires a high-privilege RELEASE_TOKEN and uses third-party Actions without commit-hash pinning; audit it separately for enterprise use.
- Mainland-China users should verify reachability of GitHub, npm, the Terraform Registry, MCP, and relevant cloud endpoints.
What does this skill do, and when should you use it?
This skill supports AI coding agents working with Terraform or OpenTofu across testing, module design, state management, CI/CD, security, and compliance. AWS, Azure, and GCP are all treated as supported clouds, although AWS is the default in examples. It provides decision matrices, workflows, implementation patterns, and anti-patterns for infrastructure teams. The README states compatibility with Claude Code, Cursor, Copilot, Gemini CLI, OpenCode, Codex, Kiro, and other Agent Skills-compatible clients.
Guides module structure, naming, versioning, inputs, outputs, and documentation for Terraform and OpenTofu projects; helps choose native tests or Terratest and plan static, integration, and end-to-end testing; designs S3, Azure, GCS, or Terraform Cloud remote-state configurations with locking, encryption, isolation, migration, and recovery considerations; outlines GitHub Actions, GitLab CI, and Atlantis workflows; incorporates TFLint, Trivy, Checkov, Infracost, policy-as-code, and compliance-scanning patterns; and can optionally work with terraform-ls or the Terraform MCP server.
- An infrastructure engineer choosing native tests or Terratest for AWS, Azure, or GCP modules.
- A platform team designing remote state, locking, encryption, and state isolation for multiple teams and environments.
- A DevOps team creating CI/CD workflows with formatting, validation, linting, security scanning, cost estimation, and reviewed plan artifacts.
- A Terraform developer standardizing reusable-module layout, naming, version constraints, inputs, outputs, and documentation.
- A security or compliance team adding Trivy, Checkov, policy-as-code, and compliance checks to infrastructure workflows.
What are this skill's strengths and limitations?
- Covers both Terraform and OpenTofu.
- Addresses testing, modules, state, CI/CD, security, and compliance in one skill.
- Names AWS, Azure, and GCP as first-class targets and includes cross-cloud mapping guidance.
- Includes decision matrices, DO/DON'T patterns, and version-specific guidance.
- Documents installation paths for several Agent Skills-compatible hosts.
- SKILL.md is not cached, so its actual frontmatter, full body, and bundled files cannot be verified.
- The README does not show the complete implementation, test suite, or validation results.
- AWS receives the most prominent examples; the depth of Azure and GCP coverage cannot be confirmed from the README alone.
- Terraform MCP server and terraform-ls are optional and require local configuration.
- Repository metadata says NOASSERTION for the license, while the README states Apache 2.0; the repository license file should be checked.
How do you install this skill?
For an Agent Skills-compatible tool, run: npx skills add https://github.com/antonbabenko/terraform-skill. For Codex, the README gives a clone target of ~/.agents/skills/terraform-skill. For Claude Code, install terraform-skill through the antonbabenko/agent-plugins marketplace. The README does not provide cached frontmatter, but it identifies the skill content at skills/terraform-skill/SKILL.md.
How do you use this skill?
After installation, give the supported agent a Terraform or OpenTofu task such as: "Create a Terraform module for an AWS VPC with native tests", "Configure an S3 backend with native use_lockfile locking and encryption", or "Create a GitHub Actions workflow for Terraform with cost estimation."
How does this skill compare with similar options?
The README explicitly compares Terraform's native test framework with Go-based Terratest and provides a decision matrix for choosing between them. It also covers both Terraform and OpenTofu, but does not provide a systematic comparison with other infrastructure skills or products.