cloudgeni-ai/opengeni/checkov

Checkov

Use this skill when the user asks to scan Terraform or infrastructure-as-code for security, compliance, or best-practice issues.

Workflow

1. Confirm the repository path before scanning. Repository resources are usually mounted under /workspace/repos/<host>/<owner>/<repo>; use the session's resolved resource path instead of guessing.
2. Run Checkov from the repository root or the relevant Terraform subdirectory:

checkov -d . --framework terraform --compact

1. For a machine-readable result that is easier to inspect and summarize, write JSON to a temporary file:

checkov -d . --framework terraform -o json --output-file-path /tmp/checkov-results

1. Summarize the failed checks in plain language. Include the check ID, file, resource, and reason.
2. When the user asks for fixes, edit only the selected findings. Keep changes focused and preserve the existing Terraform style.
3. Validate after edits:

terraform fmt -recursive
terraform init -backend=false
terraform validate
checkov -d . --framework terraform --compact

1. If GitHub credentials are available, create a branch and draft pull request for the fix.

Guardrails

• Do not run terraform apply unless the user explicitly asks for it.
• Prefer terraform init -backend=false for validation so remote state is not touched.
• Do not suppress Checkov findings unless the user asks for a suppression and the reason is documented in code.
• If provider credentials are missing, still run static checks and explain which validation steps could not be completed.