skill CX Codex

iac-security-scan-skills — Claude Code skill: setup and features

Q: How to install iac-security-scan-skills in Claude Code?

Run `npx skills add reason-machines/security-skills --skill iac-security-scan-skills -a claude-code` in your terminal. This registers the definition under `~/.claude/skills/iac-security-scan-skills/SKILL.md`.

Q: Which formats are available for the final scan output?

The scanner writes results into `iac-scan/` including `report.html`, `findings.csv`, an architecture visualizer, and domain-specific Markdown summaries.

Infrastructure-as-Code security scanner for Terraform and CloudFormation. Detects cross-domain attack paths and suggests minimal fixes to eliminate exposure points.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add reason-machines/security-skills --skill iac-security-scan-skills -a claude-code

Open on GitHub

What iac-security-scan-skills does

This skill evaluates cloud definitions across Terraform and CloudFormation codebases. The workflow consists of three stages: mapping structural boundaries, scanning isolated domains concurrently (such as IAM, networking, storage, secrets, and logging), and aggregating cross-domain attack paths that link initial perimeter access to internal workloads.

Rather than stopping at isolated rule violations, the engine grades findings using a 0.0 to 1.0 confidence score and calculates the minimum-cut fix set required to disrupt attack graphs. Users can trigger complete audits, scoped runs for selected focus areas, or a single-pass fast scan tailored for pull requests.

Attack chain correlation requires selecting at least two domains during a scoped scan. Every output artifact is written to the local iac-scan/ directory as Markdown summaries, an HTML dashboard, and CSV spreadsheets, which means adding that directory to .gitignore is necessary right away.

What it helps with

detect privilege escalation opportunities in IAM policies and role assumptions
trace multi-hop lateral movement paths spanning from public ingress to backend databases
flag plaintext cloud credentials embedded inside deployment templates
audit S3 buckets and data stores lacking backup locks or encryption
produce an interactive HTML overview of infrastructure vulnerabilities

Example prompts for the agent

Run IaC security scan on the terraform/ directory
Scan only IAM and network
Generate security report from previous scan results

How to install iac-security-scan-skills

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill iac-security-scan-skills -a claude-code

2Manually: put the files in place

~/.claude/skills/iac-security-scan-skills/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/iac-security-scan-skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill iac-security-scan-skills -a codex

2Manually: put the files in place

.agents/skills/iac-security-scan-skills/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill iac-security-scan-skills -a cursor

2Manually: put the files in place

.cursor/skills/iac-security-scan-skills/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install reason-machines/security-skills iac-security-scan-skills

2Manually: put the files in place

.github/skills/iac-security-scan-skills/SKILL.md

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill iac-security-scan-skills -a gemini-cli

2Platform CLI

gemini skills install https://github.com/reason-machines/security-skills --path skills/iac-security-scan-skills

Manually: put the files in place

.devin/skills/iac-security-scan-skills/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill iac-security-scan-skills -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about iac-security-scan-skills

How to install iac-security-scan-skills in Claude Code?

Run npx skills add reason-machines/security-skills --skill iac-security-scan-skills -a claude-code in your terminal. This registers the definition under ~/.claude/skills/iac-security-scan-skills/SKILL.md.

What happens during a fast scan mode?

A fast scan evaluates templates in a single pass, outputting only High and Critical severity items. It skips composite attack path analysis to provide rapid feedback for code reviews.

Which formats are available for the final scan output?

The scanner writes results into iac-scan/ including report.html, findings.csv, an architecture visualizer, and domain-specific Markdown summaries.

Similar skills

All skills for Security →

git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set69

dfyx-code-security-auditor A white-box code audit skill that traces data flows and checks security weaknesses. Use it for release reviews, OWASP checks, or a deeper project assessment. CX Codex +1 334installs dfyx-code-security-audit This skill audits source code for vulnerabilities through data-flow analysis and business-logic review. Use it for a project security check or pentest preparation. CX Codex +1 328installs eastsword-dfyx-code-security-review This skill runs white-box security audits by tracking data flows and spotting authorization or injection flaws. It suits projects preparing code for production. CX Codex +1 327installs pentest-skills-framework A modular skill for reconnaissance, vulnerability checks, and result analysis through natural-language requests. It fits AI CLI penetration-testing workflows. CX Codex +1 327installs security-investigator-automation A skill that runs security investigations across Microsoft Sentinel, Defender XDR and Graph API from a plain-language request. CX Codex +1 322installs malwarebytes-premium-security-cracked-distribution This skill covers a pirated, pre-activated Malwarebytes Premium build and flags the security and legal risks. It should not be used to obtain cracked software. CX Codex +1 320installs linux-pentester-commands A Linux command reference for reconnaissance, enumeration, exploitation, and privilege escalation during authorized penetration testing. CX Codex +1 319installs linux-pentester-command-reference A skill that hands your agent a Linux command reference split by pentest phase: recon, enumeration, exploitation, privesc. CX Codex +1 308installs