Checkov

When to use this skill

Use Checkov when an AI agent needs a reusable SKILL.md workflow for this job: Use Checkov to scan Terraform and infrastructure-as-code repositories for policy violations, explain findings, choose safe fixes, rerun scans, and prepare pull requests with remediations.

When not to use it

Skip Checkov when the task is outside the coding category, or when a more specific skill in this directory already covers the same workflow with clearer triggers.

How to install

1. Personal install: create ~/.claude/skills/checkov/SKILL.md (and any bundled scripts) so Claude Code, Claude Desktop, and compatible agents can load it in every project.
2. Project install: commit the same folder at .claude/skills/checkov/ so teammates get the skill with the repo.
3. Restart the agent session after copying files so it re-scans the skills directory, then ask for the task in words that match the skill description.

Full install guide for Claude, Cursor, and Codex

What this skill does

# Checkov

Use this skill when the user asks to scan Terraform or infrastructure-as-code for security, compliance, or best-practice issues.

## Workflow

1. Confirm the repository path before scanning. Repository resources are usually mounted under `/workspace/repos/<host>/<owner>/<repo>`; use the session's resolved resource path instead of guessing. 2. Run Checkov from the repository root or the relevant Terraform subdirectory:

```bash checkov -d . --framework terraform --compact ```

3. For a machine-readable result that is easier to inspect and summarize, write JSON to a temporary file:

```bash checkov -d . --framework terraform -o json --output-file-path /tmp/checkov-results ```

4. Summarize the failed checks in plain language. Include the check ID, file, resource, and reason. 5. When the user asks for fixes, edit only the selected findings. Keep changes focused and preserve the existing Terraform style. 6. Validate after edits:

```bash terraform fmt -recursive terraform init -backend=false terraform validate checkov -d . --framework terraform --compact ```

7. If GitHub credentials are available, create a branch and draft pull request for the fix.

## Guardrails

- Do not run `terraform apply` unless the user explicitly asks for it. - Prefer `terraform init -backend=false` for validation so remote state is not touched. - Do not suppress Checkov findings unless the user asks for a suppression and the reason is documented in code. - If provider credentials are missing, still run static checks and explain which validation steps could not be completed.

Intended uses

• Confirm the repository path before scanning. Repository resources are usually mounted under /workspace/repos/<host>/<owner>/<repo>; use the session's resolved resource path instead of guessing.
• Run Checkov from the repository root or the relevant Terraform subdirectory:
• For a machine-readable result that is easier to inspect and summarize, write JSON to a temporary file:
• Summarize the failed checks in plain language. Include the check ID, file, resource, and reason.
• When the user asks for fixes, edit only the selected findings. Keep changes focused and preserve the existing Terraform style.
• Validate after edits:
• If GitHub credentials are available, create a branch and draft pull request for the fix.