iac-scan

# Vulnetix IaC Scan Skill ## Use when - Pre-apply: scan `*.tf` / `*.tofu` for misconfigurations. - PR review: catch open security groups, plaintext secrets, IAM wildcards. - Audit existing infra against compliance baselines (CIS, NIST). - Detect drift between repo IaC and deployed state. - Pre-merge: gate on critical findings (e.g. publicly-readable S3). ## Don't use for - Source-code SAST — use `/vulnetix:sast-scan`. - Dockerfile / container analysis — use `/vulnetix:container-scan`. - Cloud runtime monitoring — Pix is static-only; use a CSPM for runtime. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Confirm `derived.has_iac: true` or `--paths` provided. Otherwise abort. ## Step 2: Run scan ```bash vulnetix iac --paths "$PATHS" -o json > .vulnetix/iac.${TIMESTAMP}.json ``` Captures: open security groups, missing encryption, public S3/GCS, IAM wildcards, unpinned providers, secrets in plaintext, missing tags, unencrypted state backends. ## Step 3: Render | Severity | File:Line | Resource | Issue | Re...