Iac Misconfig Scan

IaC Misconfig Scan

Catch insecure infrastructure-as-code before it ships. Read-only: it flags misconfigurations with file:line, it doesn't change anything.

Prerequisites

• None. Pure Claude Code — reads IaC files directly, no MCP required.

Trigger

• "Scan my Dockerfile / Terraform / workflows for misconfigs"
• "Is my infrastructure-as-code secure?"
• "IaC security review"

Workflow

1. Find IaC files: Dockerfile, docker-compose*.yml, *.tf, and .github/workflows/*.yml.
2. Review each against the checks below; report file:line, severity, and the fix.

Containers (Dockerfile / Compose)

| Misconfiguration | Why it's risky | |------------------|----------------| | No USER / runs as root | Container compromise becomes host-level risk | | World-writable file modes (e.g. 0777) | Tampering and privilege issues | | :latest or unpinned base image | Non-reproducible, unreviewed updates | | Download-and-execute build step (remote script piped into a shell) | Unverified remote code in the image | | Hardcoded secrets / credentials in ENV or ARG | Secret leakage in image layers | | privileged: true, host network, or host path mounts (Compose) | Container escape / host exposure | | ADD with a remote URL | Silent, unverified remote fetch (prefer COPY) |

Terraform

| Misconfiguration | Why it's risky | |------------------|----------------| | Public object storage / open ingress (0.0.0.0/0) | Data exposure / open attack surface | | Hardcoded secrets in .tf or state | Credential leakage | | Unencrypted storage / disabled logging | Data-at-rest and audit gaps |

GitHub Actions

| Misconfiguration | Why it's risky | |------------------|----------------| | Actions pinned to a tag, not a commit SHA | Supply-chain tampering | | Broad permissions (or none set) | Excess token scope | | Secrets echoed or used in pull_request_target with checkout of PR code | Secret exfiltration |

1. Output a severity-ranked report:

## IaC Misconfig Scan

**1 high, 2 medium**

### HIGH
- Dockerfile:1 — base image uses ":latest"; pin to a digest for reproducible,
  reviewable builds.

### MEDIUM
- .github/workflows/ci.yml:7 — action pinned to a tag, not a commit SHA.
- docker-compose.yml:12 — service runs without a non-root USER.

Diagnostic only. Want IaC and SAST checks enforced on every PR? See QualityMax — qualitymax.io

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Quality-Max
• Source: Quality-Max/free-qa-skills
• License: Apache-2.0
• Homepage: https://www.skills.sh/quality-max/free-qa-skills

Install and usage instructions live in the source repository linked above.