What do I need to use Infrastructure-as-Code Review?

IaC tool; Cloud provider; What the code provisions; Security policies or naming standards in use; The IaC code itself.

Is Infrastructure-as-Code Review free to use?

Yes — run it free in the browser playground (no API key needed for the sponsored trial, or bring any provider key), or install it into Claude Code, Cursor, ChatGPT and more via npx pm-claude-skills. MIT-licensed and open source.

Infrastructure-as-Code Review

Q: How do I know the Infrastructure-as-Code Review output is good?

The skill verifies itself against its own quality checks: Every finding includes: severity, category, specific resource name, file and line number, current code, and fixed code; Checklist covers all 12 categories: IAM, Secrets, Encryption at Rest, Encryption in Transit, Network, Logging, Naming/Tagging, State, Module Structure, Environment Parity, Cost, and Drift; Executive summary table is filled with real counts — not all zeros or all placeholders; "Required Actions Before Merge" section lists only Critical and High items.

🔵 Stable🕐 updated 2026-06-08 🔷 SkillSpec L3 pm-engineering

Write an infrastructure-as-code review checklist and conduct a structured review of Terraform, CloudFormation, Pulumi, or Ansible code. Use when asked to review IaC code, audit infrastructure configurations, check cloud security posture, or produce a reusable IaC review checklist. Produces a structured review report with severity-categorized findings, remediation guidance, and a reusable checklist.

▶ Run it free — no key needed 📝 Grade your existing draft View SKILL.md ↗

What to give it

▸IaC tool — Terraform, CloudFormation, Pulumi, Ansible, or CDK

▸Cloud provider — AWS, GCP, Azure, or multi-cloud

▸What the code provisions — a brief description (e.g., "VPC, EKS cluster, and RDS instance for the payments service")

▸Security policies or naming standards in use — any existing org standards to check against; if none, use sensible defaults

▸The IaC code itself — paste or describe it; if not provided, produce the checklist template only and note findings require code

✅ The bar it holds itself to

Every skill in this library self-verifies — these are this skill's own quality checks, straight from its definition.

✓Every finding includes: severity, category, specific resource name, file and line number, current code, and fixed code

✓Checklist covers all 12 categories: IAM, Secrets, Encryption at Rest, Encryption in Transit, Network, Logging, Naming/Tagging, State, Module Structure, Environment Parity, Cost, and Drift

✓Executive summary table is filled with real counts — not all zeros or all placeholders

✓"Required Actions Before Merge" section lists only Critical and High items

✓Code snippets in findings show both the problematic code AND the corrected version

✓Overall risk rating is justified by the highest-severity open finding

✓Checklist items are binary (checkable) — not narrative observations

⚠️ What it refuses to do

Do not mark a finding as Low if it involves hardcoded credentials or secrets in any form — always Critical

Do not review IaC in isolation from the deployment context — networking and IAM must be evaluated together

Do not produce narrative findings without the specific resource name, file, and line number

Do not skip the "Required Actions Before Merge" summary — reviewers need a clear blocking list, not just a full report

Do not approve code where encryption at rest or in transit is missing on data stores, even if not explicitly flagged by the requester

Install

npx pm-claude-skills add --agent claude   # or codex · cursor · gemini · hermes
# or one-line MCP (every skill, any client):
claude mcp add pm-skills -- npx -y pm-claude-skills-mcp

Start with

Related skills

🔌 Embed this skill

Drop this on your blog, docs, or site — it renders a "Run this skill" card:

<div data-pm-skill="infra-as-code-review"></div>
<script src="https://mohitagw15856.github.io/pm-claude-skills/embed.js" async></script>

💬 Discussion

Infrastructure-as-Code Review is one of 1078 open-source professional AI agent skills — all SkillSpec L3. Try them all in the browser · ⭐ Star on GitHub · Browse the full catalog