intermediateCoding & Development

Checkov

Use Checkov to scan Terraform and infrastructure-as-code repositories for policy violations, explain findings, choose safe fixes, rerun scans, and prepare pull requests with remediations.

View source
82OpxScoreProvisional
Community resultNot enough feedback0 votes
Model evidenceNo verified testsModel fit pending

Score breakdown

Estimated from the available content and source signals.

Provisional
Documentation92
Practical value92
Evidence56
Source trust70

Model compatibility

Inferred fit is not the same as a recorded hands-on test.

ClaudeuntestedNo model-specific signal or recorded compatibility test was found.
ChatGPTuntestedNo model-specific signal or recorded compatibility test was found.
GeminiuntestedNo model-specific signal or recorded compatibility test was found.
CopilotuntestedNo model-specific signal or recorded compatibility test was found.
LlamauntestedNo model-specific signal or recorded compatibility test was found.
PerplexityuntestedNo model-specific signal or recorded compatibility test was found.
MistraluntestedNo model-specific signal or recorded compatibility test was found.
GrokuntestedNo model-specific signal or recorded compatibility test was found.

Overview

Checkov

Use this skill when the user asks to scan Terraform or infrastructure-as-code for security, compliance, or best-practice issues.

Workflow

  1. Confirm the repository path before scanning. Repository resources are usually mounted under /workspace/repos/<host>/<owner>/<repo>; use the session's resolved resource path instead of guessing.
  2. Run Checkov from the repository root or the relevant Terraform subdirectory:
checkov -d . --framework terraform --compact
  1. For a machine-readable result that is easier to inspect and summarize, write JSON to a temporary file:
checkov -d . --framework terraform -o json --output-file-path /tmp/checkov-results
  1. Summarize the failed checks in plain language. Include the check ID, file, resource, and reason.
  2. When the user asks for fixes, edit only the selected findings. Keep changes focused and preserve the existing Terraform style.
  3. Validate after edits:
terraform fmt -recursive
terraform init -backend=false
terraform validate
checkov -d . --framework terraform --compact
  1. If GitHub credentials are available, create a branch and draft pull request for the fix.

Guardrails

  • Do not run terraform apply unless the user explicitly asks for it.
  • Prefer terraform init -backend=false for validation so remote state is not touched.
  • Do not suppress Checkov findings unless the user asks for a suppression and the reason is documented in code.
  • If provider credentials are missing, still run static checks and explain which validation steps could not be completed.

Best for

  • Confirm the repository path before scanning. Repository resources are usually mounted under /workspace/repos/<host>/<owner>/<repo>; use the session's resolved resource path instead of guessing.
  • Run Checkov from the repository root or the relevant Terraform subdirectory:
  • For a machine-readable result that is easier to inspect and summarize, write JSON to a temporary file:
  • Summarize the failed checks in plain language. Include the check ID, file, resource, and reason.
  • When the user asks for fixes, edit only the selected findings. Keep changes focused and preserve the existing Terraform style.
  • Validate after edits:
  • If GitHub credentials are available, create a branch and draft pull request for the fix.

Tips and best practices

  • Review the source instructions and adapt inputs before running the workflow.

What This Skill Can Do

AI-generated examples showing real capabilities

Was this skill useful?

Be the first to share a result.

Related skills