# Infra Lint

> Lint Terraform, Terragrunt, and Helm charts only — skips application and frontend checks. Use for infrastructure-only changes when /lint would be overkill.

- **Type:** Skill
- **Install:** `agentstack add skill-makigjuro-cloudstack-ai-plugins-infra-lint`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [makigjuro](https://agentstack.voostack.com/s/makigjuro)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [makigjuro](https://github.com/makigjuro)
- **Source:** https://github.com/makigjuro/cloudstack-ai-plugins/tree/main/plugins/cloud-infra/skills/infra-lint
- **Website:** https://github.com/makigjuro/cloudstack-ai-plugins#quick-start

## Install

```sh
agentstack add skill-makigjuro-cloudstack-ai-plugins-infra-lint
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Infrastructure Lint

Fast lint for infrastructure files only. Skips application and frontend checks.

## Arguments

- `--fix` or `fix` — Apply auto-fixes (formatting only)
- `terraform` — Only lint Terraform/Terragrunt
- `helm` — Only lint Helm charts

If no argument, lint both Terraform and Helm.

## Configuration

Read `cloudstack.json` from the project root at the start of execution. Extract:
- `CHARTS_PATH` = `infrastructure.chartsPath` (default: `deploy/charts`)
- `TF_PATH` = `infrastructure.terraformPath` (default: `infra/terraform/modules`)
- `TG_PATH` = `infrastructure.terragruntPath` (default: `infra/terragrunt`)
- `IAC_WRAPPER` = `infrastructure.iacWrapper` (default: `none`)

If `cloudstack.json` does not exist, auto-detect by scanning the project structure. Derive `TF_PARENT` as the parent directory of `TF_PATH` (e.g., if `TF_PATH` is `infra/terraform/modules`, `TF_PARENT` is `infra`).

## Terraform / Terragrunt

**Format check:**
```bash
terraform fmt -check -recursive {TF_PARENT}
```

**Format fix (if `--fix`):**
```bash
terraform fmt -recursive {TF_PARENT}
```

**Validate modules:**
```bash
for dir in $(find {TF_PATH} -name "*.tf" -exec dirname {} \; | sort -u); do
  echo "=== Validating $dir ==="
  terraform -chdir="$dir" init -backend=false -input=false 2>/dev/null
  terraform -chdir="$dir" validate
done
```

**Terragrunt validate (only if `IAC_WRAPPER` = `terragrunt`):**
```bash
find {TG_PATH} -name "terragrunt.hcl" -execdir terragrunt validate \;
```

## Helm Charts

**Lint all charts:**
```bash
for chart in {CHARTS_PATH}/*/; do
  echo "=== Linting $chart ==="
  helm lint "$chart"
  helm template test "$chart" > /dev/null
done
```

If `{CHARTS_PATH}/` doesn't exist, skip Helm linting and note it.

## Security Scan

After lint passes, invoke the `trivy-scan` skill as the final verification step. This catches security misconfigurations that `terraform validate` and `helm lint` don't see (public access defaults, weak TLS, over-broad IAM, missing encryption).

```
Skill(skill="cloud-infra:trivy-scan")
```

Findings suppressed by a committed `.trivyignore` (with justifying comments) don't block — only unsuppressed CRITICAL/HIGH/MEDIUM fail the gate.

If trivy isn't installed, the skill prints the install command and exits non-zero. Treat that as a FAIL for this skill's output but print the install hint so the user can remediate.

## Output

Report pass/fail per category:
```
- Terraform Format: PASS/FAIL
- Terraform Validate: PASS/FAIL
- Terragrunt Validate: PASS/FAIL (or SKIPPED if IAC_WRAPPER != terragrunt)
- Helm Lint: PASS/FAIL (or SKIPPED)
- Helm Template: PASS/FAIL (or SKIPPED)
- Security Scan (trivy): PASS/FAIL (or SKIPPED if trivy missing)
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [makigjuro](https://github.com/makigjuro)
- **Source:** [makigjuro/cloudstack-ai-plugins](https://github.com/makigjuro/cloudstack-ai-plugins)
- **License:** MIT
- **Homepage:** https://github.com/makigjuro/cloudstack-ai-plugins#quick-start

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-makigjuro-cloudstack-ai-plugins-infra-lint
- Seller: https://agentstack.voostack.com/s/makigjuro
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.