# Terrashark

Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes...

- Repository: https://github.com/LukasNiessen/terrashark (716 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add LukasNiessen/terrashark --skill terrashark -g -a claude-code -y`
Codex: `npx skills add LukasNiessen/terrashark --skill terrashark -g -a codex -y`
Cursor: `npx skills add LukasNiessen/terrashark --skill terrashark -g -a cursor -y`
Gemini CLI: `npx skills add LukasNiessen/terrashark --skill terrashark -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add LukasNiessen/terrashark`

## Description

Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Terrashark: Failure-Mode Workflow for Terraform/OpenTofu

Run this workflow top to bottom.

## 1) Capture execution context

Record before writing code:
- runtime (`terraform` or `tofu`) and exact version
- provider(s), target platform, and state backend
- execution path (local CLI, CI, HCP Terraform/TFE, Atlantis)
- environment criticality (dev/shared/prod)

If unknown, state assumptions explicitly.

## 2) Diagnose likely failure mode(s)

Select one or more based on user intent and risk:
- identity churn: resource addressing instability, refactor breakage
- secret exposure: secrets in state, logs, defaults, artifacts
- blast radius: oversized stacks, weak boundaries, unsafe applies
- CI drift: version mismatch, unreviewed applies, missing artifacts
- compliance gate gaps: missing policies/approvals/audit controls

## 3) Load only the relevant reference file(s)

Primary references:
- `references/identity-churn.md`
- `references/secret-exposure.md`
- `references/blast-radius.md`
- `references/ci-drift.md`
- `references/compliance-gates.md`

Supplemental references (only when needed):
- `references/testing-matrix.md`
- `references/quick-ops.md`
- `references/examples-good.md`
- `references/examples-bad.md`
- `references/examples-neutral.md`
- `references/coding-standards.md`
- `references/module-architecture.md`
- `references/ci-delivery-patterns.md`
- `references/security-and-governance.md`
- `references/do-dont-patterns.md`
- `references/mcp-integration.md`

Conditional references (CRR; load only on detected signals):
- `references/conditional/backend-state-safety.md` (backend is `s3`, `azurerm`, `gcs`, `remote`, `cloud`, `pg`, `consul`, or `local`, or task mentions backend migration, locking, state backup, or restore)
- `references/conditional/trusted-modules.md` (provider is `aws`, `azurerm`, `google`, `oci`, or `ibm`)

Do not load multiple conditional references unless the task spans multiple detected backends, providers, or tools.

The rest: https://github.com/LukasNiessen/terrashark/blob/HEAD//SKILL.md