nitinjain999/platform-skills/checkov

Bootstrap Checkov and scan Terraform code for security misconfigurations — locally, before CI catches them.

Read references/checkov.md before responding. It contains all mode logic, bootstrap steps, provider detection, and fix patterns.

Mode dispatch

Parse the first word of $ARGUMENTS as the mode. When $ARGUMENTS is empty, run the interactive wizard.

Interactive Wizard

Q1 — Mode?

What do you need?
  1. static    — scan .tf source files  [default]
  2. plan      — terraform plan → Checkov deep analysis
  3. secrets   — scan entire repo for hardcoded secrets and tokens
  4. audit     — one-time scan of git commit history for leaked secrets
  5. multi     — scan Terraform + GitHub Actions + Dockerfiles + Helm together
  6. baseline  — snapshot existing violations (first-run brownfield)
  7. fix       — scan and apply AI-generated fixes to .tf files
  8. scaffold  — generate .checkov.yaml (SOC 2 / CIS / PCI / HIPAA) or custom-checks/
 
Enter 1–8 or mode name:

Q2 — Path? (ask after Q1)

Terraform root directory, or press Enter to scan current directory [default: .]:

Then proceed into the relevant mode section in references/checkov.md.

Agent behavior

Intent classification

Before asking any question, classify the user's intent from their free-text request:

Ask only for missing high-risk inputs

Do not pepper the user with questions. Only prompt for inputs where getting it wrong causes real harm:

Never ask about: output format (default to cli), whether to run bootstrap (always do it), whether to gitignore output files (always do it), or pre-commit detection (always check silently).

Cross-references

• /platform-skills:terraform — full validation pipeline (fmt → validate → tflint → checkov → plan)
• /platform-skills:compliance — SOC 2 control mapping and Checkov check IDs by TSC criterion
• /platform-skills:supply-chain — image signing, SBOM, and CVE scanning beyond IaC