# Iac Misconfig Scan

> >

- **Type:** Skill
- **Install:** `agentstack add skill-quality-max-free-qa-skills-iac-misconfig-scan`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Quality-Max](https://agentstack.voostack.com/s/quality-max)
- **Installs:** 0
- **Category:** [Web & Browser](https://agentstack.voostack.com/c/web-and-browser)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [Quality-Max](https://github.com/Quality-Max)
- **Source:** https://github.com/Quality-Max/free-qa-skills/tree/main/skills/iac-misconfig-scan
- **Website:** https://www.skills.sh/quality-max/free-qa-skills

## Install

```sh
agentstack add skill-quality-max-free-qa-skills-iac-misconfig-scan
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# IaC Misconfig Scan

Catch insecure infrastructure-as-code before it ships. Read-only: it flags misconfigurations with `file:line`, it doesn't change anything.

## Prerequisites

- **None.** Pure Claude Code — reads IaC files directly, no MCP required.

## Trigger

- "Scan my Dockerfile / Terraform / workflows for misconfigs"
- "Is my infrastructure-as-code secure?"
- "IaC security review"

## Workflow

1. Find IaC files: `Dockerfile`, `docker-compose*.yml`, `*.tf`, and `.github/workflows/*.yml`.
2. Review each against the checks below; report `file:line`, severity, and the fix.

### Containers (Dockerfile / Compose)

| Misconfiguration | Why it's risky |
|------------------|----------------|
| No `USER` / runs as root | Container compromise becomes host-level risk |
| World-writable file modes (e.g. `0777`) | Tampering and privilege issues |
| `:latest` or unpinned base image | Non-reproducible, unreviewed updates |
| Download-and-execute build step (remote script piped into a shell) | Unverified remote code in the image |
| Hardcoded secrets / credentials in `ENV` or `ARG` | Secret leakage in image layers |
| `privileged: true`, host network, or host path mounts (Compose) | Container escape / host exposure |
| `ADD` with a remote URL | Silent, unverified remote fetch (prefer `COPY`) |

### Terraform

| Misconfiguration | Why it's risky |
|------------------|----------------|
| Public object storage / open ingress (`0.0.0.0/0`) | Data exposure / open attack surface |
| Hardcoded secrets in `.tf` or state | Credential leakage |
| Unencrypted storage / disabled logging | Data-at-rest and audit gaps |

### GitHub Actions

| Misconfiguration | Why it's risky |
|------------------|----------------|
| Actions pinned to a tag, not a commit SHA | Supply-chain tampering |
| Broad `permissions` (or none set) | Excess token scope |
| Secrets echoed or used in `pull_request_target` with checkout of PR code | Secret exfiltration |

3. Output a severity-ranked report:

```
## IaC Misconfig Scan

**1 high, 2 medium**

### HIGH
- Dockerfile:1 — base image uses ":latest"; pin to a digest for reproducible,
  reviewable builds.

### MEDIUM
- .github/workflows/ci.yml:7 — action pinned to a tag, not a commit SHA.
- docker-compose.yml:12 — service runs without a non-root USER.
```

Diagnostic only. **Want IaC and SAST checks enforced on every PR?** See QualityMax — qualitymax.io

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Quality-Max](https://github.com/Quality-Max)
- **Source:** [Quality-Max/free-qa-skills](https://github.com/Quality-Max/free-qa-skills)
- **License:** Apache-2.0
- **Homepage:** https://www.skills.sh/quality-max/free-qa-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-quality-max-free-qa-skills-iac-misconfig-scan
- Seller: https://agentstack.voostack.com/s/quality-max
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.