skilldrop-cli 0.16.3__py3-none-any.whl

skilldrop_cli/data/packs/infra-as-code/skills/terraform-module/examples/s3-log-bucket/main.tf

@@ -0,0 +1,153 @@
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+locals {
+  default_tags = {
+    "managed-by" = "terraform"
+    "module"     = "s3-log-bucket"
+  }
+  tags = merge(local.default_tags, var.tags)
+
+  # Narrow log delivery to named source buckets when given; otherwise any bucket in this account.
+  log_source_arns = length(var.access_log_source_bucket_arns) > 0 ? var.access_log_source_bucket_arns : ["arn:${data.aws_partition.current.partition}:s3:::*"]
+}
+
+resource "aws_s3_bucket" "this" {
+  bucket        = var.bucket_name
+  force_destroy = var.force_destroy
+  tags          = local.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.retention_days > var.transition_to_ia_days
+      error_message = "retention_days must be greater than transition_to_ia_days, or objects expire before they transition."
+    }
+  }
+}
+
+# Public access off: all four settings on.
+resource "aws_s3_bucket_public_access_block" "this" {
+  bucket = aws_s3_bucket.this.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+# ACLs disabled; the bucket owner owns every object, so access is governed by policy only.
+resource "aws_s3_bucket_ownership_controls" "this" {
+  bucket = aws_s3_bucket.this.id
+
+  rule {
+    object_ownership = "BucketOwnerEnforced"
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
+  bucket = aws_s3_bucket.this.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm     = var.kms_key_arn == null ? "AES256" : "aws:kms"
+      kms_master_key_id = var.kms_key_arn
+    }
+    bucket_key_enabled = var.kms_key_arn != null
+  }
+}
+
+resource "aws_s3_bucket_versioning" "this" {
+  bucket = aws_s3_bucket.this.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "this" {
+  bucket = aws_s3_bucket.this.id
+
+  rule {
+    id     = "log-retention"
+    status = "Enabled"
+
+    filter {}
+
+    transition {
+      days          = var.transition_to_ia_days
+      storage_class = "STANDARD_IA"
+    }
+
+    expiration {
+      days = var.retention_days
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 30
+    }
+
+    abort_incomplete_multipart_upload {
+      days_after_initiation = 7
+    }
+  }
+
+  depends_on = [aws_s3_bucket_versioning.this]
+}
+
+data "aws_iam_policy_document" "this" {
+  statement {
+    sid     = "DenyInsecureTransport"
+    effect  = "Deny"
+    actions = ["s3:*"]
+    resources = [
+      aws_s3_bucket.this.arn,
+      "${aws_s3_bucket.this.arn}/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+      values   = ["false"]
+    }
+  }
+
+  dynamic "statement" {
+    for_each = var.allow_s3_server_access_logs ? [1] : []
+
+    content {
+      sid       = "AllowS3ServerAccessLogDelivery"
+      effect    = "Allow"
+      actions   = ["s3:PutObject"]
+      resources = ["${aws_s3_bucket.this.arn}/*"]
+
+      principals {
+        type        = "Service"
+        identifiers = ["logging.s3.amazonaws.com"]
+      }
+
+      condition {
+        test     = "StringEquals"
+        variable = "aws:SourceAccount"
+        values   = [data.aws_caller_identity.current.account_id]
+      }
+
+      condition {
+        test     = "ArnLike"
+        variable = "aws:SourceArn"
+        values   = local.log_source_arns
+      }
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "this" {
+  bucket = aws_s3_bucket.this.id
+  policy = data.aws_iam_policy_document.this.json
+
+  depends_on = [aws_s3_bucket_public_access_block.this]
+}

skilldrop_cli/data/packs/infra-as-code/skills/terraform-module/examples/s3-log-bucket/outputs.tf

@@ -0,0 +1,14 @@
+output "bucket_name" {
+  description = "Name of the log bucket. Use it as the target bucket in logging configuration."
+  value       = aws_s3_bucket.this.id
+}
+
+output "bucket_arn" {
+  description = "ARN of the log bucket, for IAM policies that read the logs."
+  value       = aws_s3_bucket.this.arn
+}
+
+output "bucket_regional_domain_name" {
+  description = "Regional domain name of the bucket."
+  value       = aws_s3_bucket.this.bucket_regional_domain_name
+}

skilldrop_cli/data/packs/infra-as-code/skills/terraform-module/examples/s3-log-bucket/variables.tf

@@ -0,0 +1,71 @@
+variable "bucket_name" {
+  description = "Globally unique name for the log bucket. Lowercase letters, numbers, dots and hyphens, 3 to 63 characters."
+  type        = string
+
+  validation {
+    condition     = can(regex("^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$", var.bucket_name))
+    error_message = "bucket_name must be 3-63 characters of lowercase letters, numbers, dots and hyphens, starting and ending with a letter or number."
+  }
+}
+
+variable "retention_days" {
+  description = "Days to keep log objects before they expire. Must be longer than transition_to_ia_days."
+  type        = number
+  default     = 365
+
+  validation {
+    condition     = var.retention_days >= 1 && var.retention_days <= 3650 && floor(var.retention_days) == var.retention_days
+    error_message = "retention_days must be a whole number between 1 and 3650."
+  }
+}
+
+variable "transition_to_ia_days" {
+  description = "Days after which log objects move to STANDARD_IA. S3 requires at least 30."
+  type        = number
+  default     = 30
+
+  validation {
+    condition     = var.transition_to_ia_days >= 30 && floor(var.transition_to_ia_days) == var.transition_to_ia_days
+    error_message = "transition_to_ia_days must be a whole number of at least 30."
+  }
+}
+
+variable "kms_key_arn" {
+  description = "ARN of a customer-managed KMS key for SSE-KMS. Leave null to use SSE-S3 (AES256), which is what most AWS log delivery services require."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = var.kms_key_arn == null || can(regex("^arn:aws[a-z-]*:kms:", var.kms_key_arn))
+    error_message = "kms_key_arn must be null or a KMS key ARN starting with arn:aws...:kms:."
+  }
+}
+
+variable "allow_s3_server_access_logs" {
+  description = "Add a bucket policy statement that lets the S3 logging service write server access logs into this bucket from buckets in the same account."
+  type        = bool
+  default     = true
+}
+
+variable "access_log_source_bucket_arns" {
+  description = "ARNs of the buckets allowed to deliver server access logs here. Empty means any bucket in this account."
+  type        = list(string)
+  default     = []
+
+  validation {
+    condition     = alltrue([for arn in var.access_log_source_bucket_arns : can(regex("^arn:aws[a-z-]*:s3:::", arn))])
+    error_message = "Each entry in access_log_source_bucket_arns must be an S3 bucket ARN (arn:aws:s3:::name)."
+  }
+}
+
+variable "force_destroy" {
+  description = "Allow terraform destroy to delete the bucket even when it still holds logs. Keep false outside throwaway environments."
+  type        = bool
+  default     = false
+}
+
+variable "tags" {
+  description = "Tags to add to every resource. Merged over the module defaults; your values win on a key clash."
+  type        = map(string)
+  default     = {}
+}

skilldrop_cli/data/packs/infra-as-code/skills/terraform-module/examples/s3-log-bucket/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.0, < 7.0"
+    }
+  }
+}

skilldrop_cli/data/packs/infra-as-code/skills/terraform-module/examples/s3-log-bucket.md

@@ -0,0 +1,50 @@
+# Worked example: an S3 bucket for access logs
+
+## Input
+
+> *"We need a Terraform module for a log bucket on AWS. Our S3 buckets send server access logs there, and we keep them a year. Several teams will call it."*
+
+All three inputs are present (need, cloud, callers), so no questions are asked.
+
+## Stated defaults and assumptions
+
+- Terraform `>= 1.5.0`; AWS provider `>= 5.0, < 7.0`.
+- SSE-S3 (AES256) by default, with SSE-KMS as an opt-in through `kms_key_arn`, because some AWS log delivery services do not support SSE-KMS on the destination bucket.
+- Retention 365 days, transition to STANDARD_IA at 30 days (the S3 minimum for that transition).
+- `[assumption]` Log sources are in the same account as the bucket. Cross-account delivery needs a wider policy and is left out.
+
+## Output
+
+The module is in [`s3-log-bucket/`](s3-log-bucket/README.md):
+
+| File | What to look at |
+|---|---|
+| `s3-log-bucket/versions.tf` | Bounded provider constraint, Terraform floor |
+| `s3-log-bucket/variables.tf` | Every input typed and described; validation on the bucket name, day counts, KMS ARN format and source bucket ARNs |
+| `s3-log-bucket/main.tf` | Public access block, `BucketOwnerEnforced`, encryption, versioning, lifecycle, TLS-only policy, log delivery scoped by `aws:SourceAccount` from `data.aws_caller_identity`; a `precondition` checks retention is longer than the transition |
+| `s3-log-bucket/outputs.tf` | Name, ARN and regional domain name, each described |
+| `s3-log-bucket/examples/basic/main.tf` | A caller with a provider block and placeholder names |
+| `s3-log-bucket/README.md` | Inputs and outputs tables matching the code |
+
+How it meets the quality bar:
+
+- **Secure by default.** A caller who sets only `bucket_name` gets a private, encrypted, versioned, TLS-only bucket that `terraform destroy` will not empty (`force_destroy = false`).
+- **Least privilege.** The only Allow statement is `s3:PutObject` for `logging.s3.amazonaws.com`, limited to this account and, when `access_log_source_bucket_arns` is set, to named source buckets.
+- **Nothing hard-coded.** The account ID and partition come from data sources; the region comes from the caller's provider.
+- **One tags variable.** `merge(local.default_tags, var.tags)` on the bucket. The bucket's sub-resources (public access block, policy, lifecycle and so on) do not take tags in the AWS provider.
+
+## Validation status
+
+Run on 2026-10-01 with Terraform 1.16.4, on the module and on its `examples/basic` caller:
+
+```text
+$ terraform fmt -recursive -check
+$ terraform init -backend=false && terraform validate
+Success! The configuration is valid.
+```
+
+`fmt -check` printed nothing and exited 0. `validate` passed with the AWS provider at 6.67.0
+(the newest the `>= 5.0, < 7.0` range allows), and again with the range pinned to 5.100.0 and
+to 5.0.0, so both ends of the stated range hold. `validate` checks syntax, types and
+references; it does not call AWS. Run `terraform plan` against a real account before relying
+on the module.

skilldrop_cli/data/packs/infra-as-code/skills/terraform-module/manifest.json

@@ -0,0 +1,41 @@
+{
+  "name": "terraform-module",
+  "version": "0.1.1",
+  "description": "Generate a Terraform module from a described need, with main.tf, variables.tf, outputs.tf and versions.tf, typed and validated variables, secure defaults (encryption on, public access off, least-privilege IAM), a merged tags variable, a basic usage example and a README with inputs and outputs tables. Use when the user says \"write a terraform module for\", \"create terraform for an S3 bucket / VPC / database\", \"turn this into a reusable module\", or \"scaffold infrastructure as code for\".",
+  "entrypoint": "SKILL.md",
+  "deps": {
+    "npm": [],
+    "pip": []
+  },
+  "env": {
+    "required": [],
+    "optional": []
+  },
+  "related": [
+    "capacity-cost-model",
+    "migration-plan",
+    "pre-merge-review",
+    "terraform-plan-review",
+    "threat-model"
+  ],
+  "handoff": [
+    {
+      "to": "terraform-plan-review",
+      "when": "the module has been planned from examples/basic or a real caller",
+      "purpose": "Check the plan for destroys, stateful changes and access widening before the first apply.",
+      "fallback": "If terraform-plan-review is absent, read the plan for any -/+ or destroy lines and any 0.0.0.0/0 or wildcard IAM before applying."
+    }
+  ],
+  "tags": [
+    "terraform",
+    "infrastructure-as-code",
+    "module",
+    "security-defaults",
+    "aws",
+    "hcl"
+  ],
+  "model": {
+    "tier": "standard",
+    "rationale": "Structured generation against fixed module conventions and a secure-defaults checklist; the judgment is bounded to choosing defaults and validation rules for a described need."
+  }
+}

skilldrop_cli/data/packs/infra-as-code/skills/terraform-module/reference.md

@@ -0,0 +1,105 @@
+# terraform-module reference
+
+## Version constraints
+
+| Constraint | Meaning | Use it for |
+|---|---|---|
+| `">= 5.0, < 7.0"` | Any 5.x or 6.x | Reusable modules that should work across two provider majors you have tested |
+| `"~> 5.40"` | `>= 5.40` and `< 6.0` | Modules that rely on a feature added in a specific minor release |
+| `"~> 5.40.0"` | `>= 5.40.0` and `< 5.41.0` | Root configurations only, never a shared module; it blocks callers from upgrading |
+| `">= 5.0"` | Anything from 5.0 up, including future majors | Avoid. A breaking major release lands on the next `terraform init` |
+
+`required_version` constrains the Terraform CLI. `>= 1.5.0` is a safe floor for the features this skill uses (`optional()` object attributes, `precondition`, `check` blocks). The exact pinning of provider builds belongs in the caller's `.terraform.lock.hcl`, which the root configuration commits. A module does not ship a lock file.
+
+## Variable patterns
+
+```hcl
+variable "environment" {
+  description = "Deployment environment. One of dev, staging, prod."
+  type        = string
+  validation {
+    condition     = contains(["dev", "staging", "prod"], var.environment)
+    error_message = "environment must be one of: dev, staging, prod."
+  }
+}
+
+variable "allowed_cidrs" {
+  description = "CIDR blocks allowed to reach the service. Empty means no ingress."
+  type        = list(string)
+  default     = []
+  validation {
+    condition     = alltrue([for c in var.allowed_cidrs : can(cidrhost(c, 0))])
+    error_message = "Each allowed_cidrs entry must be a valid CIDR block, e.g. 10.0.0.0/16."
+  }
+  validation {
+    condition     = !contains(var.allowed_cidrs, "0.0.0.0/0")
+    error_message = "0.0.0.0/0 is not allowed here. Put a public load balancer in front instead."
+  }
+}
+
+variable "backup" {
+  description = "Backup settings. Retention in days; window in UTC as hh24:mi-hh24:mi."
+  type = object({
+    retention_days = optional(number, 7)
+    window         = optional(string, "03:00-04:00")
+  })
+  default = {}
+}
+
+variable "db_password" {
+  description = "Master password. Pass it from a secret manager, never a literal in tfvars."
+  type        = string
+  sensitive   = true
+}
+```
+
+- Validation that compares two variables: use a `precondition` in the `lifecycle` block of the resource that depends on them. Cross-variable references inside `validation` blocks only work on recent Terraform releases, so a precondition is the portable choice.
+- Use `nullable = false` on variables whose `null` value would break the module, so callers who pass `null` get the default instead.
+- Name variables for what the caller decides (`retention_days`), not for the resource argument it feeds (`expiration_days_rule_0`).
+
+## Secure defaults by cloud
+
+| Concern | AWS | Google Cloud | Azure |
+|---|---|---|---|
+| Encryption at rest | S3 SSE configuration resource; `storage_encrypted = true` on RDS; `encrypted = true` on EBS | Encrypted by default; add `encryption { default_kms_key_name }` when a customer-managed key is required | Encrypted by default; customer-managed keys through the service's key settings |
+| Public access off | `aws_s3_bucket_public_access_block` with all four settings `true`; `publicly_accessible = false` on RDS | `public_access_prevention = "enforced"` and `uniform_bucket_level_access = true` on buckets | `public_network_access_enabled = false`, `allow_nested_items_to_be_public = false` on storage accounts |
+| TLS only | Bucket policy denying `aws:SecureTransport = false` | HTTPS-only is the API default | `https_traffic_only_enabled = true` (named `enable_https_traffic_only` in older provider versions), `min_tls_version = "TLS1_2"` |
+| Accidental destroy | `deletion_protection = true`, `skip_final_snapshot = false`, `force_destroy = false` | `deletion_protection = true` on Cloud SQL; `force_destroy = false` on buckets | Resource locks via `azurerm_management_lock` |
+| Least privilege | `aws_iam_policy_document` with named actions and resource ARNs; conditions such as `aws:SourceAccount` | Predefined roles over primitive roles (`roles/storage.objectViewer`, not `roles/editor`); `google_*_iam_member` over `_iam_policy`, which replaces all bindings | Built-in roles at the narrowest scope; avoid `Owner` and `Contributor` at subscription scope |
+| Network | No `0.0.0.0/0` ingress by default; security group rules take CIDRs from a variable | Firewall rules with explicit source ranges and target tags | NSG rules with explicit source prefixes |
+
+Check argument names against the provider version you constrain to. Provider majors rename and remove arguments; the table names the current common forms.
+
+## Tagging and labelling
+
+```hcl
+locals {
+  default_tags = {
+    "managed-by" = "terraform"
+    "module"     = "<module-name>"
+  }
+  tags = merge(local.default_tags, var.tags)   # caller wins on a clash
+}
+```
+
+- AWS: apply `tags = local.tags` on every taggable resource. Callers can also set `default_tags` on their provider block; the module's tags merge with those.
+- Google Cloud: use `labels`. Keys and values must be lowercase letters, numbers, underscores and hyphens, so validate them.
+- Azure: `tags` on every resource that supports them. Resource groups do not pass tags to their children.
+
+## Secrets and identifiers checklist
+
+- No account IDs, project IDs, subscription IDs or tenant IDs as literals. Use `data "aws_caller_identity"`, `data "google_client_config"`, `data "azurerm_client_config"`.
+- No region literals in the module. The caller's provider sets it; read it with `data "aws_region"` if needed.
+- No passwords, keys or tokens as variable defaults. Take them as `sensitive = true` variables, generate them with a managed feature (RDS `manage_master_user_password = true`), or read them from a secret manager data source.
+- Outputs that expose a secret are `sensitive = true`.
+- Remember that sensitive values are still written to state in clear text. State needs an encrypted backend with restricted access; say so in the README when the module handles secrets.
+
+## Checks to recommend
+
+| Tool | What it catches | Command |
+|---|---|---|
+| `terraform fmt` | Formatting | `terraform fmt -recursive -check` |
+| `terraform validate` | Syntax, types, references | `terraform init -backend=false && terraform validate` |
+| `terraform plan` | What would actually be created | Run from `examples/basic` against a sandbox |
+| tflint | Provider-specific mistakes such as invalid instance types | `tflint --init && tflint` |
+| checkov | Security misconfigurations | `checkov -d .` |

skilldrop_cli/data/packs/infra-as-code/skills/terraform-module/templates/module-readme.md

@@ -0,0 +1,55 @@
+# <module-name>
+
+<One or two sentences: what this module creates and what it is for. Name the secure defaults a caller gets without setting anything.>
+
+## Usage
+
+```hcl
+module "<instance-name>" {
+  source = "<registry, git or relative path>"
+
+  <required_input> = <placeholder value>
+
+  tags = {
+    "environment" = "<env>"
+    "owner"       = "<team>"
+  }
+}
+```
+
+A runnable version is in `examples/basic`.
+
+## What it creates
+
+| Resource | Why |
+|---|---|
+| `<type>.<name>` | <the job it does, and the secure setting it carries> |
+
+## Inputs
+
+| Name | Type | Default | Description |
+|---|---|---|---|
+| `<name>` | `<type>` | (required) or `<default>` | <what the caller decides, and the valid range> |
+| `tags` | `map(string)` | `{}` | Extra tags, merged over the module defaults |
+
+## Outputs
+
+| Name | Description |
+|---|---|
+| `<name>` | <what a caller uses it for> |
+
+## Notes
+
+- <Any opt-in variable that weakens a default, and what it opens.>
+- <Where account or project IDs come from: a data source, never a literal.>
+- This module does not configure a provider or backend. The caller sets region, credentials and state.
+
+## Before you apply
+
+```bash
+terraform fmt -recursive
+terraform init -backend=false && terraform validate
+terraform plan   # from examples/basic, against a sandbox
+```
+
+Run `tflint` and `checkov -d .` too if your team uses them.

skilldrop_cli/data/packs/infra-as-code/skills/terraform-plan-review/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: terraform-plan-review
+description: Review a terraform plan before apply, from the plan text or terraform show -json output. Flags every destroy and replace with the attribute forcing it, changes to stateful resources such as databases, buckets and volumes, IAM and security-group widening, drift nobody made in code, and changes outside the intended scope, then gives a SAFE TO APPLY, APPLY WITH CARE or DO NOT APPLY verdict with reasons. Use when the user pastes a plan, says "review this terraform plan", "is this plan safe to apply", "why is terraform replacing my database", or "check the plan before I apply".
+---
+
+# terraform-plan-review
+
+Reads a `terraform plan` the way a careful second engineer would before anyone types `apply`: find what will be destroyed, what holds data, what opens access, and what nobody asked for. The output is a verdict plus the specific resource addresses behind it, so the person applying knows exactly what to check or fix. The plan is the evidence. The HCL diff that produced it is reviewed by `pre-merge-review`, and writing the module in the first place is `terraform-module`.
+
+## How to respond
+
+1. **Get the plan and the intent, asking once for what is missing.** Two inputs matter: the plan itself and one sentence on what the change is meant to do ("bump the app instance size"). Ask for both in one message if either is missing; the intent is what makes "outside the intended scope" checkable. Prefer the JSON form, because it carries `replace_paths`, `action_reason` and `resource_drift` that the text form only shows as comments:
+   ```bash
+   terraform plan -out=tfplan
+   terraform show -json tfplan > plan.json
+   ```
+   Warn the user once that the JSON plan contains sensitive values in clear text (they are only marked by `before_sensitive` / `after_sensitive`), so it is not something to paste into a ticket.
+
+2. **For a JSON plan, run the summary script first.** It counts the actions, lists every flagged change and the drift, and prints a mechanical floor verdict. It never prints attribute values.
+   ```bash
+   # Claude Code
+   python3 "${CLAUDE_SKILL_DIR}/scripts/plan_summary.py" plan.json --scope module.api --scope aws_lb.public
+   # Other IDEs (from the skill folder)
+   python3 scripts/plan_summary.py plan.json --scope module.api --scope aws_lb.public
+   ```
+   Turn the stated intent into `--scope` address prefixes. If the intent is too vague to map to addresses, run without `--scope` and do the scope check by hand in step 6. For a text plan, skip the script and read the symbols with the table in [`reference.md`](reference.md): `-/+` and `+/-` are replacements, and the attribute marked `# forces replacement` is the cause.
+
+3. **Flag every destroy and every replace, with its cause.** List each one by full address, the action (`["delete"]`, `["delete","create"]`, `["create","delete"]`), and the attribute that forces it (`replace_paths`, or `# forces replacement` in text). ✅ *"`aws_db_instance.orders` destroy-then-create, forced by `storage_encrypted`"*. ❌ *"Some resources will be recreated."* A count is not a review. Name the `action_reason` when the plan gives one: `replace_because_tainted` and `replace_by_request` mean someone asked for it, `delete_because_no_resource_config` means the block was removed from code.
+
+4. **Treat stateful resources as their own class.** Databases, buckets, volumes, file systems, caches, queues, KMS keys and secrets hold data or identity that a replacement does not bring back. For each one being destroyed or replaced, state what is lost and what would recover it: a final snapshot (`skip_final_snapshot`), deletion protection, versioning, a recent backup. If the plan shows `skip_final_snapshot = true` or `deletion_protection = false` on a database being replaced, say so plainly; that combination loses the data on apply. In-place updates to stateful resources get a line too, because some (instance class, storage type, engine version) cause a restart or a long modification window.
+
+5. **Check access changes as widening or narrowing.** Compare before and after for security groups, firewall rules, IAM policies and role bindings, bucket policies and ACLs, public access blocks and KMS key policies. Widening means a new `0.0.0.0/0` or `::/0` ingress, `Principal: "*"`, a wildcard `Action` such as `s3:*` or `*`, `Resource: "*"`, a public access block turned off, or a new trust relationship. Quote the before and after of the specific statement or rule. Open egress on its own is normal, so note it without escalating.
+
+6. **Separate drift from the change.** Drift is anything changed outside Terraform since the last apply: `resource_drift` in JSON, or the "Objects have changed outside of Terraform" section in text. For each drifted resource, say whether this plan will undo it (reverting a hotfix someone made in the console) or leave it. Then check scope: every change whose address falls outside the stated intent is listed, even when harmless, because unexplained changes are how a stale branch or a provider upgrade slips in.
+
+7. **Give the verdict with reasons.** Exactly one of:
+   - **SAFE TO APPLY**: every change is in scope, nothing stateful is destroyed or replaced, no access is widened, no unexplained drift.
+   - **APPLY WITH CARE**: in-scope replacements of stateless resources, in-place changes to stateful ones, drift the plan will overwrite, or out-of-scope changes the user can explain. List the checks to do first.
+   - **DO NOT APPLY**: a stateful resource destroyed or replaced without a confirmed backup, public or admin-level access widened, a plan that errored, or a large out-of-scope change. Say what has to change in code or process before re-planning.
+   The script's floor verdict is a minimum. Raise it on judgment; lower it only when the user confirms the change is intended and recoverable, and say that in the output.
+
+8. **Emit the review in one message** in this order: verdict line, a counts line (create / update / replace / destroy), the flagged changes ordered by severity (🟥 blocks apply, 🟧 check first, 🟨 note), drift, out-of-scope changes, then "Before you apply" as a numbered list of concrete actions (take a snapshot, add `lifecycle { prevent_destroy = true }`, split the PR, re-plan with `-target` only as a one-off). If the change will need an apply and rollback procedure, hand off to `runbook-generator`. If a replacement implies moving data, hand off to `migration-plan`.
+
+**Non-interactive runs** (subagent, CI, headless): a missing intent becomes `[assumption] intent inferred from the plan's in-place changes`, stated first, and the scope check is marked as unverified. A missing plan, a truncated plan (no `Plan:` line in text, or JSON that fails to parse) or a plan that says it errored emits `BLOCKED: need the full terraform plan output (preferably terraform show -json tfplan)`. Never review a partial plan as if it were complete.
+
+## Useful references in this skill
+
+- [`reference.md`](reference.md): text plan symbols, the JSON plan fields this skill reads (`resource_changes`, `change.actions`, `replace_paths`, `action_reason`, `resource_drift`), the stateful and access resource classes, and the verdict rules
+- [`scripts/plan_summary.py`](scripts/plan_summary.py): stdlib summariser for `terraform show -json` output (counts, flagged changes, drift, floor verdict; exits 2 on bad input)
+- [`examples/northwind-orders.md`](examples/northwind-orders.md): worked example, a plan meant to resize an app tier that would also replace the database, with script output and the full review
+- [`examples/northwind-orders-plan.json`](examples/northwind-orders-plan.json): the hand-built JSON plan used in that example
+
+## Quality bar
+
+- **Every destroy and replace is listed by full address with its cause.** The attribute forcing the replacement is named, from `replace_paths` or `# forces replacement`.
+- **Every stateful resource that is destroyed or replaced says what data is at risk and what recovers it.** Missing backups are called out, not assumed.
+- **Access changes quote the before and after** of the rule or statement, and say whether access widens or narrows.
+- **Drift is reported separately from intended change**, with whether the plan reverts it.
+- **Out-of-scope changes are listed** against the user's stated intent.
+- **Exactly one verdict**, with the reasons behind it and a numbered "Before you apply" list.
+- **No invented resources or attributes.** Every address and attribute in the review appears in the plan the user supplied.
+- **No secret values are echoed** from the plan, even when the plan contains them.
+
+## When to use this skill
+
+- ✅ Someone pastes `terraform plan` output or a `terraform show -json` file and asks if it is safe
+- ✅ A plan unexpectedly wants to replace a database, bucket or cluster and the user wants to know why
+- ✅ A CI pipeline needs a gate on plans before apply
+- ✅ Checking a plan after a provider or module version bump for changes nobody wrote
+
+## When NOT to use this skill
+
+- ❌ Reviewing the HCL or application code diff in a pull request: use `pre-merge-review`
+- ❌ Writing a new Terraform module: use `terraform-module`
+- ❌ Planning a data or platform migration end to end, with cutover and rollback: use `migration-plan`
+- ❌ Estimating what the new infrastructure will cost: use `capacity-cost-model`
+- ❌ Writing the step-by-step apply and rollback procedure for on-call: use `runbook-generator`
+
+## Anti-patterns to avoid
+
+- ❌ **Reading only the summary line.** "Plan: 3 to add, 2 to change, 1 to destroy" hides which one is the production database. Read every resource block.
+- ❌ **Treating `-/+` as an update.** A replacement creates a new object with a new ID; for a database that means an empty database unless restored from a snapshot.
+- ❌ **Calling drift "noise".** Drift is often a console hotfix during an incident; applying silently reverts it.
+- ❌ **Fixing a scary plan with `-target` as a habit.** It hides the rest of the plan and leaves state out of step with code. Fix the code, then re-plan the whole thing.
+- ❌ **Approving IAM changes by resource name.** `aws_iam_role_policy.app` changing tells you nothing; the policy document diff tells you everything.
+- ❌ **Pasting the JSON plan into a ticket or chat.** It holds sensitive values in clear text.
+- ❌ **Hedged verdicts.** "Probably fine" is not a verdict. Pick one of the three and give the reason.

skilldrop_cli/data/packs/infra-as-code/skills/terraform-plan-review/evals/eval_queries.json

@@ -0,0 +1,34 @@
+[
+  {
+    "query": "Review this terraform plan before I apply it",
+    "should_trigger": true
+  },
+  {
+    "query": "Why does terraform want to replace my RDS instance? Plan output attached",
+    "should_trigger": true
+  },
+  {
+    "query": "Here's terraform show -json for tomorrow's change, is it safe to apply?",
+    "should_trigger": true
+  },
+  {
+    "query": "Check this plan for destroys, IAM widening and drift before we run apply in prod",
+    "should_trigger": true
+  },
+  {
+    "query": "Review the Terraform changes in this pull request diff before I merge",
+    "should_trigger": false
+  },
+  {
+    "query": "Plan the migration of our Postgres database to an encrypted instance with cutover and rollback",
+    "should_trigger": false
+  },
+  {
+    "query": "Write the on-call runbook for applying infrastructure changes and rolling them back",
+    "should_trigger": false
+  },
+  {
+    "query": "Estimate the monthly cost of moving the app tier to m6i.xlarge",
+    "should_trigger": false
+  }
+]