Iac Security Agent Skill
> Performs a security review of Infrastructure as Code templates against the OWASP IaC Security Cheat Sheet, SLSA v1.0, and CIS Benchmarks. Auto-invoked when reviewing Terraform, CloudFormation, or Pulumi configurations. Detects hardcoded secrets, public exposure patterns, encryption gaps, overly permissive IAM, and misconfigurations equivalent to Checkov, tfsec, and KICS rules. Produces a structured findings report with remediation guidance.
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/UnitOneAI/SecuritySkills --skill iac-securityOther skills for the same job
different authors, same section of the catalogue
This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.
Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges
Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.
Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
Comprehensive AWS security posture assessment using AWS CLI and security best practices
How to use it
Take unitoneai/iac-security from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.