Agent skill · security · aiskillstore
iac-checkov
Infrastructure as Code (IaC) security scanning using Checkov with 750+ built-in policies for Terraform, CloudFormation, Kubernetes, Dockerfile, and ARM templates. Use when: (1) Scanning IaC files for security misconfigurations and compliance violations, (2) Validating cloud infrastructure against CIS, PCI-DSS, HIPAA, and SOC2 benchmarks, (3) Detecting secrets and hardcoded credentials in IaC, (4) Implementing policy-as-code in CI/CD pipelines, (5) Generating compliance reports with remediation guidance for cloud security posture management.
Why this skill is useful
Provides specific commands and policies for scanning IaC files that the AI wouldn't reliably generate on its own.
What it needs
Requires checkov, python installed locally. About 9k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Infrastructure as Code Security with Checkov Overview Checkov is a static code analysis tool that scans Infrastructure as Code (IaC) files for security misconfigurations and compliance violations before deployment. With 750+ built-in policies, Checkov helps prevent cloud security issues by detecting problems in Terraform, CloudFormation, Kubernetes, Dockerfiles, Helm charts, and ARM templates. Checkov performs graph-based scanning to understand resource relationships and detect complex misconfigurations that span multiple resources, making it more powerful than simple pattern matching. Quick Start Install Checkov Scan Terraform Directory Scan Kubernetes Manifests Scan CloudFormation Template Core Workflow Step 1: Understand Scan Scope Identify IaC files and frameworks to scan: Scope Considerations: Scan entire infrastructure directory for comprehensive coverage Focus on specific frameworks during initial adoption Exclude generated or vendor files Include both production and non-production configurations Step 2: Run Basic Scan Execute Checkov with appropriate output format: What Checkov Detects: Security misconfigurations (unencrypted resources, public access) Compliance violations (CIS benchmarks, industry standards) Secrets and hardcoded credentials Missing security controls (logging, monitoring, encryption) Insecure network configurations Resource relationship issues (via graph analysis) Step 3: Filter and Prioritize Findings Focus on critical issues first: Severity Levels: CRITICAL: Immediate security risks (public S3 buckets, unencrypted databases) HIGH: Significant security concerns (missing MFA, weak encryption) MEDIUM: Important security best practices (missing tags, logging disabled) LOW: Recommendations and hardening (resource naming conventions) Step 4: Suppress False Positives Use inline suppression for legitimate exceptions: See references/suppressionguide.md for comprehensive suppression strategies. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/iac-checkov