terrashark

Category: Testing & Security | Uploader: LukasNiessen | Downloads: 0 | Version: v1.0（Latest）

Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines.

Changelog: Source: GitHub https://github.com/LukasNiessen/terrashark

Directory Structure

Current level: tree/main/

📁 .claude/
- 📄 settings.local.json 66 B
📁 .claude-plugin/
- 📄 marketplace.json 371 B
📁 .github/
- 📁 workflows/
  - 📄 deploy-docs.yml 1.2 KB
  - 📄 stale.yml 1.4 KB
  - 📄 validate.yml 2.9 KB
- 📄 dependabot.yml 522 B
- 📄 PULL_REQUEST_TEMPLATE.md 1007 B
📁 assets/
- 📄 logo.png 193.3 KB
📁 docs/
- 📁 advanced/
  - 📄 comparison.md 3.6 KB
  - 📄 token-efficiency.md 3.1 KB
- 📁 architecture/
  - 📄 coding-standards.md 3.6 KB
  - 📄 module-architecture.md 3.0 KB
  - 📄 structure-and-state.md 2.0 KB
- 📁 core-concepts/
  - 📄 failure-modes.md 4.9 KB
  - 📄 philosophy.md 6.3 KB
  - 📄 workflow.md 4.9 KB
- 📁 examples/
  - 📄 bad-patterns.md 2.7 KB
  - 📄 do-dont-checklist.md 3.3 KB
  - 📄 good-patterns.md 3.5 KB
  - 📄 neutral-patterns.md 1.9 KB
- 📁 failure-modes/
  - 📄 blast-radius.md 2.3 KB
  - 📄 ci-drift.md 3.9 KB
  - 📄 compliance-gates.md 3.4 KB
  - 📄 identity-churn.md 4.0 KB
  - 📄 secret-exposure.md 2.9 KB
- 📁 getting-started/
  - 📄 installation.md 2.5 KB
  - 📄 quick-start.md 2.4 KB
- 📁 guides/
  - 📄 ci-delivery.md 4.8 KB
  - 📄 migration-playbooks.md 2.7 KB
  - 📄 quick-ops.md 3.5 KB
  - 📄 security-governance.md 2.0 KB
  - 📄 testing.md 3.5 KB
- 📁 integrations/
  - 📄 mcp-integration.md 1.4 KB
- 📄 .gitignore 21 B
- 📄 book.json 660 B
- 📄 changelog.md 837 B
- 📄 contributing.md 2.1 KB
- 📄 package-lock.json 97.7 KB
- 📄 package.json 323 B
- 📄 README.md 3.0 KB
- 📄 SUMMARY.md 1.7 KB
📁 references/
- 📄 blast-radius.md 1.8 KB
- 📄 ci-delivery-patterns.md 5.0 KB
- 📄 ci-drift.md 3.6 KB
- 📄 coding-standards.md 3.5 KB
- 📄 compliance-gates.md 3.0 KB
- 📄 do-dont-patterns.md 3.1 KB
- 📄 examples-bad.md 2.2 KB
- 📄 examples-good.md 3.2 KB
- 📄 examples-neutral.md 1.6 KB
- 📄 identity-churn.md 3.8 KB
- 📄 mcp-integration.md 1.4 KB
- 📄 migration-playbooks.md 2.5 KB
- 📄 module-architecture.md 2.5 KB
- 📄 quick-ops.md 3.9 KB
- 📄 secret-exposure.md 2.5 KB
- 📄 security-and-governance.md 1.7 KB
- 📄 structure-and-state.md 1.8 KB
- 📄 testing-matrix.md 3.4 KB
- 📄 token-balance-rationale.md 713 B
📄 .gitignore 27 B
📄 CHANGELOG.md 18 B
📄 CODE_OF_CONDUCT.md 943 B
📄 CONTRIBUTING.md 1.7 KB
📄 LICENSE 1.1 KB
📄 PHILOSOPHY.md 9.5 KB
📄 README.md 16.4 KB
📄 SKILL.md 2.6 KB

SKILL.md

---
name: terrashark
description: "Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines."
---

# Terrashark: Failure-Mode Workflow for Terraform/OpenTofu

Run this workflow top to bottom.

## 1) Capture execution context

Record before writing code:
- runtime (`terraform` or `tofu`) and exact version
- provider(s), target platform, and state backend
- execution path (local CLI, CI, HCP Terraform/TFE, Atlantis)
- environment criticality (dev/shared/prod)

If unknown, state assumptions explicitly.

## 2) Diagnose likely failure mode(s)

Select one or more based on user intent and risk:
- identity churn: resource addressing instability, refactor breakage
- secret exposure: secrets in state, logs, defaults, artifacts
- blast radius: oversized stacks, weak boundaries, unsafe applies
- CI drift: version mismatch, unreviewed applies, missing artifacts
- compliance gate gaps: missing policies/approvals/audit controls

## 3) Load only the relevant reference file(s)

Primary references:
- `references/identity-churn.md`
- `references/secret-exposure.md`
- `references/blast-radius.md`
- `references/ci-drift.md`
- `references/compliance-gates.md`

Supplemental references (only when needed):
- `references/testing-matrix.md`
- `references/quick-ops.md`
- `references/examples-good.md`
- `references/examples-bad.md`
- `references/examples-neutral.md`
- `references/coding-standards.md`
- `references/module-architecture.md`
- `references/ci-delivery-patterns.md`
- `references/security-and-governance.md`
- `references/do-dont-patterns.md`
- `references/mcp-integration.md`

## 4) Propose fix path with explicit risk controls

For each fix, include:
- why this addresses the failure mode
- what could still go wrong
- guardrails (tests, approvals, rollback)

## 5) Generate implementation artifacts

When applicable, output:
- HCL changes (typed vars, stable keys, bounded versions)
- migration blocks (`moved`, import strategy)
- CI pipeline updates (plan/apply separation, artifacts, policy checks)
- compliance controls (approvals, policy rules, evidence paths)

## 6) Validate before finalize

Always provide command sequence tailored to runtime and risk tier.
Never recommend direct production apply without reviewed plan and approval.

## 7) Output contract

Return:
- assumptions and version floor
- selected failure mode(s)
- chosen remediation and tradeoffs
- validation/test plan
- rollback/recovery notes for destructive-impact changes

Comments 0

Latest | Hot

Please login before commenting.

No comments yet. Be the first one!

terrashark

Directory Structure

SKILL.md

Report

Notice