[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CBH87E0QJXKM75S8RY35AH":3,"skill-same:01M6CBH87E0QJXKM75S8RY35AH":136},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":14,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":63,"install":64,"resources":77},"01M6CBH87E0QJXKM75S8RY35AH","terraform-skill",null,"Use when writing, reviewing, or debugging Terraform\u002FOpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards.","m0hill\u002Fdotfiles","m0hill","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F112541468?v=4","01M6CBEGPD8F5VRSQAA7RWDKPW","Mohil","01M6CBEGTEKRDJK1VY9E22DS37",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"terraform","terraform skill","writing","identity","debugging","blast radius","state","ci","radius","secrets","opentofu","ops","use","version","modules","2026-11-10 10:12:30",false,"---\nname: terraform-skill\ndescription: Use when writing, reviewing, or debugging Terraform\u002FOpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards.\nlicense: Apache-2.0\nmetadata:\n  author: Anton Babenko\n  version: 1.17.1\n---\n\n# Terraform Skill for Claude\n\nDiagnose-first guidance for Terraform and OpenTofu. Core file is a workflow; depth lives in references loaded on demand.\n\n## Response Contract\n\nEvery Terraform\u002FOpenTofu response must include:\n\n1. **Assumptions & version floor** — runtime (`terraform` or `tofu`), exact version, providers, state backend, execution path (local\u002FCI\u002FCloud\u002FAtlantis), environment criticality. State assumptions explicitly if the user did not provide them.\n2. **Risk category addressed** — one or more of: identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, provider upgrade risk, testing blind spots.\n3. **Chosen remediation & tradeoffs** — what was chosen, what was traded off, why.\n4. **Validation plan** — exact commands (`fmt -check`, `validate`, `plan -out`, policy check) tailored to runtime and risk tier.\n5. **Rollback notes** — for any destructive or state-mutating change: how to undo, what evidence to keep.\n\nNever recommend direct production apply without a reviewed plan artifact and approval.\n\nNever run `terraform destroy` (targeted or full) without first running `terraform plan -destroy` and showing the user every resource that will be deleted — including implicit dependents pulled in via locals or `for_each`. Get explicit confirmation before proceeding. Never use `-auto-approve` on destroy.\n\n## Workflow\n\n1. **Capture execution context** — runtime+version, provider(s), backend, execution path, environment criticality.\n2. **Diagnose failure mode(s)** using the routing table below. If intent spans categories, load both references.\n3. **Load only the matching reference file(s)** — do not preload depth the task does not need.\n4. **Propose fix with risk controls** — why this addresses the mode, what could still go wrong, guardrails (tests\u002Fapprovals\u002Frollback).\n5. **Generate artifacts** — HCL, migration blocks (`moved`, `import`), CI changes, policy rules.\n6. **Validate before finalizing** — run validation commands tailored to risk tier.\n7. **Emit the Response Contract** at the end.\n\n## Diagnose Before You Generate\n\n| Failure category | Symptoms | Primary references |\n|------------------|----------|--------------------|\n| **Identity churn** | Resource addresses shift after refactor, `count` index churn, missing `moved` blocks | [Code Patterns: count vs for_each](references\u002Fcode-patterns.md#count-vs-for_each-deep-dive), [Code Patterns: moved blocks](references\u002Fcode-patterns.md#moved-blocks-terraform-11), [Code Patterns: LLM mistakes](references\u002Fcode-patterns.md#llm-mistake-checklist--code-patterns) |\n| **Secret exposure** | Secrets in defaults, state, logs, CI artifacts | [Security & Compliance](references\u002Fsecurity-compliance.md), [Code Patterns: write-only](references\u002Fcode-patterns.md#write-only-arguments-terraform-111), [State Management](references\u002Fstate-management.md) |\n| **Blast radius** | Oversized stacks, shared prod\u002Fnon-prod state, unsafe applies | [State Management](references\u002Fstate-management.md), [Module Patterns](references\u002Fmodule-patterns.md) |\n| **Destroy cascade** | Targeted destroy deletes more than expected; locals referencing a targeted resource make all `for_each` consumers implicit dependents | Response Contract: plan-destroy first; [State Management: Safe Destroy](references\u002Fstate-management.md#safe-destroy-protocol) |\n| **CI drift** | Local plan ≠ CI plan, apply without reviewed artifact, unpinned versions | [CI\u002FCD Workflows](references\u002Fci-cd-workflows.md), [Code Patterns: versions](references\u002Fcode-patterns.md#version-management) |\n| **Compliance gaps** | Missing policy stage, no approval model, no evidence retention | [Security & Compliance](references\u002Fsecurity-compliance.md), [CI\u002FCD Workflows](references\u002Fci-cd-workflows.md) |\n| **Testing blind spots** | Plan-only validation of computed values, set-type indexing, mock\u002Freal confusion | [Testing Frameworks](references\u002Ftesting-frameworks.md) |\n| **State corruption \u002F recovery** | Stuck lock, backend migration, drift reconciliation | [State Management](references\u002Fstate-management.md) |\n| **Provider upgrade risk** | Breaking-change provider bump, unpinned modules | [Code Patterns: versions](references\u002Fcode-patterns.md#version-management), [Module Patterns](references\u002Fmodule-patterns.md) |\n| **Provider lifecycle** | Removing a provider with resources still in state, orphaned resources, `removed` block usage | [State Management: Provider Removal](references\u002Fstate-management.md#provider-removal) |\n| **Bootstrap \u002F orchestration misuse** | `null_resource` + `local-exec` for bootstrap, `remote-exec` for setup scripts, provisioner stdout leaking secrets in CI logs | [Code Patterns: Provisioners as Last Resort](references\u002Fcode-patterns.md#provisioners-as-last-resort) |\n| **Navigation \u002F safe-rename blind spots** | Cannot locate symbol defs\u002Frefs semantically, value-symbol rename done as blind text replace, grep-only refactor missing refs, hallucinated `rg` shim | [Code Intelligence](references\u002Fcode-intelligence-lsp.md#terraform-ls-capability-matrix) |\n| **Cross-cloud \u002F provider mapping** | \"What's the Azure\u002FGCP equivalent of X\", picking a backend\u002Fauth model per cloud | [State Management: Cross-cloud equivalents](references\u002Fstate-management.md#cross-cloud-equivalents) |\n\n## When to Use This Skill\n\n**Activate when:** creating or reviewing Terraform\u002FOpenTofu configurations or modules, setting up or debugging tests, structuring multi-environment deployments, implementing IaC CI\u002FCD, choosing module patterns or state organization, configuring or migrating remote state backends.\n\n**Don't use for:** basic HCL syntax questions Claude already knows, provider API reference (link to docs), cloud-platform questions unrelated to Terraform\u002FOpenTofu.\n\n## Core Principles\n\n### Module Hierarchy\n\n| Type | When to Use | Scope |\n|------|-------------|-------|\n| **Resource module** | Single logical group of connected resources | VPC + subnets, SG + rules |\n| **Infrastructure module** | Collection of resource modules for a purpose | Multiple resource modules in one region\u002Faccount |\n| **Composition** | Complete infrastructure | Spans multiple regions\u002Faccounts |\n\nFlow: resource → resource module → infrastructure module → composition.\n\n### Directory Layout\n\n```\nenvironments\u002F   # prod\u002F staging\u002F dev\u002F  — per-env configurations\nmodules\u002F        # networking\u002F compute\u002F data\u002F — reusable modules\nexamples\u002F       # minimal\u002F complete\u002F — docs + integration fixtures\n```\n\nSeparate **environments** from **modules**. Use `examples\u002F` as both documentation and test fixtures. Keep modules small and single-responsibility.\n\nSee [Module Patterns](references\u002Fmodule-patterns.md) for architecture principles, naming conventions, variable\u002Foutput contracts.\n\n### Naming Conventions (summary)\n\n- Descriptive resource names (`aws_instance.web_server`, not `aws_instance.main`)\n- Reserve `this` for genuine singleton resources only\n- Prefix variables with context (`vpc_cidr_block`, not `cidr`)\n- Standard files: `main.tf`, `variables.tf`, `outputs.tf`, `versions.tf`\n\nSee [Module Patterns: Variable Naming](references\u002Fmodule-patterns.md) and [Code Patterns: Block Ordering](references\u002Fcode-patterns.md#block-ordering--structure) for examples.\n\n### Block Ordering (summary)\n\nResource blocks: `count`\u002F`for_each` first → arguments → `tags` → `depends_on` → `lifecycle`.\nVariable blocks: `description` → `type` → `default` → `validation` → `nullable` → `sensitive`.\n\nSee [Code Patterns: Block Ordering & Structure](references\u002Fcode-patterns.md#block-ordering--structure) for the full rules and examples.\n\n## Testing Strategy\n\n### Decision Matrix: Which Testing Approach?\n\n| Situation | Approach | Tools | Cost |\n|-----------|----------|-------|------|\n| Quick syntax check | Static analysis | `validate`, `fmt` | Free |\n| Pre-commit validation | Static + lint | `validate`, `tflint`, `trivy`, `checkov` | Free |\n| Terraform 1.6+, simple logic | Native test framework | `terraform test` | Free-Low |\n| Pre-1.6, or Go expertise | Integration testing | Terratest | Low-Med |\n| Security\u002Fcompliance focus | Policy as code | OPA, Sentinel | Free |\n| Cost-sensitive workflow | Mock providers (1.7+) | Native tests + mocks | Free |\n| Multi-cloud, complex | Full integration | Terratest + real infra | Med-High |\n\n### Native Test Rules (1.6+)\n\nBefore writing test code: validate resource schemas via Terraform MCP so assertions target real attributes.\n\n- `command = plan` — fast, for input-derived values only\n- `command = apply` — required for **computed values** (ARNs, generated names) and **set-type nested blocks**\n- Set-type blocks cannot be indexed with `[0]` — use `for` expressions or materialize via `command = apply`\n- Common set types: S3 encryption rules, lifecycle transitions, IAM policy statements\n\nSee [Testing Frameworks](references\u002Ftesting-frameworks.md) for static-analysis pipelines, native-test patterns, Terratest integration, mock providers, and the full LLM-mistake checklist.\n\n## Count vs For_Each — Quick Rule\n\n| Scenario | Use | Why |\n|----------|-----|-----|\n| Boolean condition (create \u002F don't) | `count = condition ? 1 : 0` | Optional singleton toggle |\n| Items may be reordered or removed | `for_each = toset(list)` | Stable resource addresses |\n| Reference by key | `for_each = map` | Named access |\n| Multiple named resources | `for_each` | Better identity stability |\n\n**Never** use list index as long-lived identity — removing a middle element reshuffles every address after it. For the decision matrix, safe migration playbook, `moved` block patterns, and known-at-plan failure cases, see [Code Patterns: count vs for_each](references\u002Fcode-patterns.md#count-vs-for_each-deep-dive).\n\n## Locals for Dependency Management\n\nUsing `try()` in a local to prefer a conditional resource's attribute over its parent is a specialized but high-value pattern — it forces correct deletion order without explicit `depends_on`. Common use: VPC + secondary CIDR associations + subnets.\n\nSee [Code Patterns: Locals for Dependency Management](references\u002Fcode-patterns.md#locals-for-dependency-management) for the full pattern and worked example.\n\n## Module Development\n\nStandard layout:\n\n```\nmy-module\u002F\n├── README.md       # Usage documentation\n├── main.tf         # Primary resources\n├── variables.tf    # Typed inputs with descriptions\n├── outputs.tf      # Output values\n├── versions.tf     # required_version + required_providers\n├── examples\u002F\n│   ├── minimal\u002F\n│   └── complete\u002F\n└── tests\u002F\n    └── module_test.tftest.hcl   # or Go for Terratest\n```\n\n**Variable contracts**: always `description`, always explicit `type`, use `validation` for complex constraints, use `sensitive = true` for secrets, prefer `optional()` with typed defaults (1.3+) over untyped `map(any)`.\n\n**Output contracts**: always `description`, mark sensitive outputs, expose stable subsets (not whole provider objects).\n\nSee [Module Patterns](references\u002Fmodule-patterns.md) for the full contract patterns, module release checklist, and LLM-mistake checklist.\n\n## CI\u002FCD\n\nPipeline stages: **validate** → **test** → **plan** → **apply** (with environment protection).\n\nCost control: mock providers on PR validation, real-cloud integration only on main or scheduled, tag test resources, auto-cleanup.\n\nDrift prevention: pin runtime and providers, commit `.terraform.lock.hcl`, apply the **reviewed plan artifact** from the plan stage (do not re-run `plan` inside the apply job), run policy\u002Fsecurity stage on every path to apply.\n\nSee [CI\u002FCD Workflows](references\u002Fci-cd-workflows.md) for GitHub Actions, GitLab CI, and Atlantis templates plus the LLM-mistake checklist.\n\n## Security & Compliance\n\n**Essential checks:**\n\n```bash\ntrivy config .\ncheckov -d .\n```\n\n**Don't:** store secrets in variables or `.tfvars`, use default VPC, skip encryption, open security groups to `0.0.0.0\u002F0`, use inline `ingress`\u002F`egress` blocks in `aws_security_group`.\n\n**Do:** source secrets from a cloud secret manager (AWS Secrets Manager \u002F Azure Key Vault \u002F GCP Secret Manager) or use `write_only` arguments on 1.11+, create dedicated VPCs, enforce encryption at rest and TLS, least-privilege SGs, use separate `aws_vpc_security_group_{ingress,egress}_rule` resources (e.g. AWS provider v5+).\n\nMarking a variable `sensitive = true` masks display only — the value still lives in state. Use `write_only` \u002F `*_wo` on 1.11+, or keep secret material out of Terraform entirely via runtime lookups.\n\nSee [Security & Compliance](references\u002Fsecurity-compliance.md) for trivy\u002Fcheckov pipelines, state-file hardening, compliance mappings, and the LLM-mistake checklist.\n\n## State Management\n\n**Never use local state in teams or production.** Remote backends provide automatic locking, encryption, versioning, audit logging, and safe collaboration.\n\n### Choosing a Remote Backend\n\nAWS example (Azure `azurerm` \u002F GCP `gcs` \u002F TF Cloud syntax: see [State Management: Choosing a Remote Backend](references\u002Fstate-management.md#choosing-a-remote-backend)):\n\n```hcl\nterraform {\n  backend \"s3\" {\n    bucket        = \"my-terraform-state\"\n    key           = \"prod\u002Fvpc\u002Fterraform.tfstate\"\n    region        = \"us-east-1\"\n    encrypt       = true\n    use_lockfile  = true   # Native S3 locking, 1.10+\n  }\n}\n```\n\nOn Terraform \u003C 1.10, use `dynamodb_table = \"terraform-state-lock\"` instead of `use_lockfile`. Azure Storage, GCS, and Terraform Cloud all offer built-in locking - see the State Management reference for syntax. For choosing among backends and their locking models, see [Choosing a Remote Backend](references\u002Fstate-management.md#choosing-a-remote-backend).\n\n### State Organization\n\n| Pattern | Use When | Example Path |\n|---------|----------|--------------|\n| **Per environment** | Different teams per env | `prod\u002Fterraform.tfstate`, `staging\u002F...` |\n| **Per component** | Independent lifecycles | `prod\u002Fvpc\u002F`, `prod\u002Feks\u002F`, `prod\u002Frds\u002F` |\n| **Hybrid** (recommended) | Both benefits | `prod\u002Fnetworking\u002F`, `prod\u002Fcompute\u002F`, `staging\u002Fnetworking\u002F` |\n\nSplit state when: different teams, different update cadences, or >500 resources. Combine when: tightly coupled resources, \u003C100 resources, same lifecycle.\n\nSee [State Management](references\u002Fstate-management.md) for locking, migration, multi-team isolation, disaster recovery, and the LLM-mistake checklist.\n\n## Version Management\n\n| Component | Strategy | Example |\n|-----------|----------|---------|\n| Terraform runtime | Pin minor | `required_version = \"~> 1.9\"` |\n| Providers | Pin major | `version = \"~> 5.0\"` |\n| Modules (prod) | Pin exact | `version = \"5.1.2\"` |\n| Modules (dev) | Allow patch | `version = \"~> 5.1\"` |\n\nCommit `.terraform.lock.hcl` intentionally. Keep provider\u002Fruntime upgrades in a separate PR from functional changes. See [Code Patterns: Version Management](references\u002Fcode-patterns.md#version-management) for constraint syntax and upgrade workflow.\n\n## Modern Terraform Features (1.0+)\n\n| Feature | Min version | Common use |\n|---------|-------------|------------|\n| `try()` | 0.13+ | Safe fallbacks, replaces `element(concat())` |\n| `nullable = false` | 1.1+ | Prevent `null` silently overriding defaults |\n| `moved` blocks | 1.1+ | Refactor without destroy\u002Frecreate |\n| `optional()` with defaults | 1.3+ | Typed object attributes |\n| `import` blocks | 1.5+ | Declarative imports, reviewable in VCS |\n| `check` blocks | 1.5+ | Runtime assertions |\n| Native `terraform test` | 1.6+ | Built-in test framework |\n| Mock providers | 1.7+ | Cost-free unit testing |\n| `removed` blocks | 1.7+ | Declarative resource removal |\n| Provider-defined functions | 1.8+ | Provider-specific transformations (requires provider to declare functions) |\n| Cross-variable validation | 1.9+ | Reference other `var.*` in `validation` blocks |\n| `write_only` arguments | 1.11+ | Secrets never stored in state |\n| S3 native lock-file | 1.10+ | State locking without DynamoDB |\n\nBefore emitting a feature, verify the runtime floor. See [Code Patterns: Feature Guard Table](references\u002Fcode-patterns.md#feature-guard-table--version-floor--common-llm-errors) for the full table with common LLM error patterns per feature.\n\n## Runtime-Specific Guidance\n\n- **Terraform 1.0-1.5 (OpenTofu starts at 1.6)**: Terratest for integration, static analysis + plan validation only (no native tests).\n- **1.6+**: native `terraform test` \u002F `tofu test` available — migrate simple unit tests, keep Terratest for complex integration.\n- **1.7+**: mock providers cut test cost — mock for unit tests, real runs for final integration.\n- **1.10+**: S3 native lock-file (`use_lockfile`) is the correct default for new configurations — DynamoDB locking is no longer required.\n- **1.11+**: `write_only` arguments for secret handling keep credentials out of state.\n- **Terraform vs OpenTofu**: both supported. For licensing, governance, and feature delta, see [Quick Reference: Terraform vs OpenTofu](references\u002Fquick-reference.md#terraform-vs-opentofu-comparison).\n\n## Code Intelligence (terraform-ls)\n\nSemantic navigation for HCL. terraform-ls is optional; without it every row below degrades to a disclosed `rg` + Read fallback.\n\nSelf-contained terraform-ls layer of a generic code-intelligence discipline - apply the rows below directly. Recommended companion: the `code-intelligence` plugin (same `antonbabenko\u002Fagent-plugins` marketplace) carries the generic discipline (position anchoring, degradation gate, disclosure format, anti-phantom-shim) and ships `\u002Fcode-intelligence:doctor` for readiness. If it is installed, defer to its generic protocol; this skill stays fully self-contained without it.\n\n| Goal | Use | Tradeoff |\n|------|-----|----------|\n| Find definition \u002F all references | terraform-ls `goToDefinition` \u002F `findReferences` | Needs `init` + a position anchor |\n| Rename value symbol (var\u002Flocal\u002Foutput\u002Fprovider alias) | Manual: `findReferences` -> per-file fresh Read -> edit -> `validate` | No rename provider |\n| Rename resource\u002Fmodule address | `moved` block + `plan` shows 0 destroy | Text rename forces destroy\u002Frecreate |\n| Exact text \u002F known name \u002F `.tfvars` \u002F non-HCL | `rg` + Read | No semantic scope |\n\n✅ Supported: `goToDefinition`, `findReferences`, `documentSymbol`, `hover`, `workspaceSymbol`.\n❌ Unsupported: `goToImplementation`, call hierarchy, rename provider. Do not call these then report their absence as a finding.\n\n- ✅ Prereq: local `terraform`\u002F`tofu` on PATH, `terraform init` run; cold start may need one retry.\n- ✅ LSP calls are position-anchored (`file:line:character`) - anchor with `rg` first, never symbol-name-only.\n- ❌ Do not claim \"LSP broken, using rg\" until the [Degradation Gate](references\u002Fcode-intelligence-lsp.md#degradation-gate) passes; disclose any tool substitution on the first line.\n\nDepth: [Code Intelligence](references\u002Fcode-intelligence-lsp.md#terraform-ls-capability-matrix).\n\n## Reference Files\n\nProgressive disclosure — essentials here, depth on demand:\n\n- [Testing Frameworks](references\u002Ftesting-frameworks.md) — static analysis, native tests, Terratest, mock providers\n- [Module Patterns](references\u002Fmodule-patterns.md) — structure, variable\u002Foutput contracts, `terraform_remote_state` rules, release checklist\n- [CI\u002FCD Workflows](references\u002Fci-cd-workflows.md) — GitHub Actions, GitLab CI, Atlantis, cost control\n- [Security & Compliance](references\u002Fsecurity-compliance.md) — trivy\u002Fcheckov, secrets handling, compliance mappings\n- [State Management](references\u002Fstate-management.md) — backends, locking, migration, multi-team, recovery\n- [Code Patterns](references\u002Fcode-patterns.md) — block ordering, `count`\u002F`for_each` deep dive, modern features, version management, locals\n- [Code Intelligence](references\u002Fcode-intelligence-lsp.md) - terraform-ls capabilities, position-anchored calls, manual rename, degradation gate\n- [Quick Reference](references\u002Fquick-reference.md) — command cheat sheets, flowcharts, troubleshooting\n\n## License\n\nApache License 2.0. See LICENSE for full terms.\n\n**Copyright © 2026 Anton Babenko**\n","# Terraform Skill for Claude\n\nDiagnose-first guidance for Terraform and OpenTofu. Core file is a workflow; depth lives in references loaded on demand.\n\n## Response Contract\n\nEvery Terraform\u002FOpenTofu response must include:\n\n1. **Assumptions & version floor** — runtime (`terraform` or `tofu`), exact version, providers, state backend, execution path (local\u002FCI\u002FCloud\u002FAtlantis), environment criticality. State assumptions explicitly if the user did not provide them.\n2. **Risk category addressed** — one or more of: identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, provider upgrade risk, testing blind spots.\n3. **Chosen remediation & tradeoffs** — what was chosen, what was traded off, why.\n4. **Validation plan** — exact commands (`fmt -check`, `validate`, `plan -out`, policy check) tailored to runtime and risk tier.\n5. **Rollback notes** — for any destructive or state-mutating change: how to undo, what evidence to keep.\n\nNever recommend direct production apply without a reviewed plan artifact and approval.\n\nNever run `terraform destroy` (targeted or full) without first running `terraform plan -destroy` and showing the user every resource that will be deleted — including implicit dependents pulled in via locals or `for_each`. Get explicit confirmation before proceeding. Never use `-auto-approve` on destroy.\n\n## Workflow\n\n1. **Capture execution context** — runtime+version, provider(s), backend, execution path, environment criticality.\n2. **Diagnose failure mode(s)** using the routing table below. If intent spans categories, load both references.\n3. **Load only the matching reference file(s)** — do not preload depth the task does not need.\n4. **Propose fix with risk controls** — why this addresses the mode, what could still go wrong, guardrails (tests\u002Fapprovals\u002Frollback).\n5. **Generate artifacts** — HCL, migration blocks (`moved`, `import`), CI changes, policy rules.\n6. **Validate before finalizing** — run validation commands tailored to risk tier.\n7. **Emit the Response Contract** at the end.\n\n## Diagnose Before You Generate\n\n| Failure category | Symptoms | Primary references |\n|------------------|----------|--------------------|\n| **Identity churn** | Resource addresses shift after refactor, `count` index churn, missing `moved` blocks | [Code Patterns: count vs for_each](references\u002Fcode-patterns.md#count-vs-for_each-deep-dive), [Code Patterns: moved blocks](references\u002Fcode-patterns.md#moved-blocks-terraform-11), [Code Patterns: LLM mistakes](references\u002Fcode-patterns.md#llm-mistake-checklist--code-patterns) |\n| **Secret exposure** | Secrets in defaults, state, logs, CI artifacts | [Security & Compliance](references\u002Fsecurity-compliance.md), [Code Patterns: write-only](references\u002Fcode-patterns.md#write-only-arguments-terraform-111), [State Management](references\u002Fstate-management.md) |\n| **Blast radius** | Oversized stacks, shared prod\u002Fnon-prod state, unsafe applies | [State Management](references\u002Fstate-management.md), [Module Patterns](references\u002Fmodule-patterns.md) |\n| **Destroy cascade** | Targeted destroy deletes more than expected; locals referencing a targeted resource make all `for_each` consumers implicit dependents | Response Contract: plan-destroy first; [State Management: Safe Destroy](references\u002Fstate-management.md#safe-destroy-protocol) |\n| **CI drift** | Local plan ≠ CI plan, apply without reviewed artifact, unpinned versions | [CI\u002FCD Workflows](references\u002Fci-cd-workflows.md), [Code Patterns: versions](references\u002Fcode-patterns.md#version-management) |\n| **Compliance gaps** | Missing policy stage, no approval model, no evidence retention | [Security & Compliance](references\u002Fsecurity-compliance.md), [CI\u002FCD Workflows](references\u002Fci-cd-workflows.md) |\n| **Testing blind spots** | Plan-only validation of computed values, set-type indexing, mock\u002Freal confusion | [Testing Frameworks](references\u002Ftesting-frameworks.md) |\n| **State corruption \u002F recovery** | Stuck lock, backend migration, drift reconciliation | [State Management](references\u002Fstate-management.md) |\n| **Provider upgrade risk** | Breaking-change provider bump, unpinned modules | [Code Patterns: versions](references\u002Fcode-patterns.md#version-management), [Module Patterns](references\u002Fmodule-patterns.md) |\n| **Provider lifecycle** | Removing a provider with resources still in state, orphaned resources, `removed` block usage | [State Management: Provider Removal](references\u002Fstate-management.md#provider-removal) |\n| **Bootstrap \u002F orchestration misuse** | `null_resource` + `local-exec` for bootstrap, `remote-exec` for setup scripts, provisioner stdout leaking secrets in CI logs | [Code Patterns: Provisioners as Last Resort](references\u002Fcode-patterns.md#provisioners-as-last-resort) |\n| **Navigation \u002F safe-rename blind spots** | Cannot locate symbol defs\u002Frefs semantically, value-symbol rename done as blind text replace, grep-only refactor missing refs, hallucinated `rg` shim | [Code Intelligence](references\u002Fcode-intelligence-lsp.md#terraform-ls-capability-matrix) |\n| **Cross-cloud \u002F provider mapping** | \"What's the Azure\u002FGCP equivalent of X\", picking a backend\u002Fauth model per cloud | [State Management: Cross-cloud equivalents](references\u002Fstate-management.md#cross-cloud-equivalents) |\n\n## When to Use This Skill\n\n**Activate when:** creating or reviewing Terraform\u002FOpenTofu configurations or modules, setting up or debugging tests, structuring multi-environment deployments, implementing IaC CI\u002FCD, choosing module patterns or state organization, configuring or migrating remote state backends.\n\n**Don't use for:** basic HCL syntax questions Claude already knows, provider API reference (link to docs), cloud-platform questions unrelated to Terraform\u002FOpenTofu.\n\n## Core Principles\n\n### Module Hierarchy\n\n| Type | When to Use | Scope |\n|------|-------------|-------|\n| **Resource module** | Single logical group of connected resources | VPC + subnets, SG + rules |\n| **Infrastructure module** | Collection of resource modules for a purpose | Multiple resource modules in one region\u002Faccount |\n| **Composition** | Complete infrastructure | Spans multiple regions\u002Faccounts |\n\nFlow: resource → resource module → infrastructure module → composition.\n\n### Directory Layout\n\n```\nenvironments\u002F   # prod\u002F staging\u002F dev\u002F  — per-env configurations\nmodules\u002F        # networking\u002F compute\u002F data\u002F — reusable modules\nexamples\u002F       # minimal\u002F complete\u002F — docs + integration fixtures\n```\n\nSeparate **environments** from **modules**. Use `examples\u002F` as both documentation and test fixtures. Keep modules small and single-responsibility.\n\nSee [Module Patterns](references\u002Fmodule-patterns.md) for architecture principles, naming conventions, variable\u002Foutput contracts.\n\n### Naming Conventions (summary)\n\n- Descriptive resource names (`aws_instance.web_server`, not `aws_instance.main`)\n- Reserve `this` for genuine singleton resources only\n- Prefix variables with context (`vpc_cidr_block`, not `cidr`)\n- Standard files: `main.tf`, `variables.tf`, `outputs.tf`, `versions.tf`\n\nSee [Module Patterns: Variable Naming](references\u002Fmodule-patterns.md) and [Code Patterns: Block Ordering](references\u002Fcode-patterns.md#block-ordering--structure) for examples.\n\n### Block Ordering (summary)\n\nResource blocks: `count`\u002F`for_each` first → arguments → `tags` → `depends_on` → `lifecycle`.\nVariable blocks: `description` → `type` → `default` → `validation` → `nullable` → `sensitive`.\n\nSee [Code Patterns: Block Ordering & Structure](references\u002Fcode-patterns.md#block-ordering--structure) for the full rules and examples.\n\n## Testing Strategy\n\n### Decision Matrix: Which Testing Approach?\n\n| Situation | Approach | Tools | Cost |\n|-----------|----------|-------|------|\n| Quick syntax check | Static analysis | `validate`, `fmt` | Free |\n| Pre-commit validation | Static + lint | `validate`, `tflint`, `trivy`, `checkov` | Free |\n| Terraform 1.6+, simple logic | Native test framework | `terraform test` | Free-Low |\n| Pre-1.6, or Go expertise | Integration testing | Terratest | Low-Med |\n| Security\u002Fcompliance focus | Policy as code | OPA, Sentinel | Free |\n| Cost-sensitive workflow | Mock providers (1.7+) | Native tests + mocks | Free |\n| Multi-cloud, complex | Full integration | Terratest + real infra | Med-High |\n\n### Native Test Rules (1.6+)\n\nBefore writing test code: validate resource schemas via Terraform MCP so assertions target real attributes.\n\n- `command = plan` — fast, for input-derived values only\n- `command = apply` — required for **computed values** (ARNs, generated names) and **set-type nested blocks**\n- Set-type blocks cannot be indexed with `[0]` — use `for` expressions or materialize via `command = apply`\n- Common set types: S3 encryption rules, lifecycle transitions, IAM policy statements\n\nSee [Testing Frameworks](references\u002Ftesting-frameworks.md) for static-analysis pipelines, native-test patterns, Terratest integration, mock providers, and the full LLM-mistake checklist.\n\n## Count vs For_Each — Quick Rule\n\n| Scenario | Use | Why |\n|----------|-----|-----|\n| Boolean condition (create \u002F don't) | `count = condition ? 1 : 0` | Optional singleton toggle |\n| Items may be reordered or removed | `for_each = toset(list)` | Stable resource addresses |\n| Reference by key | `for_each = map` | Named access |\n| Multiple named resources | `for_each` | Better identity stability |\n\n**Never** use list index as long-lived identity — removing a middle element reshuffles every address after it. For the decision matrix, safe migration playbook, `moved` block patterns, and known-at-plan failure cases, see [Code Patterns: count vs for_each](references\u002Fcode-patterns.md#count-vs-for_each-deep-dive).\n\n## Locals for Dependency Management\n\nUsing `try()` in a local to prefer a conditional resource's attribute over its parent is a specialized but high-value pattern — it forces correct deletion order without explicit `depends_on`. Common use: VPC + secondary CIDR associations + subnets.\n\nSee [Code Patterns: Locals for Dependency Management](references\u002Fcode-patterns.md#locals-for-dependency-management) for the full pattern and worked example.\n\n## Module Development\n\nStandard layout:\n\n```\nmy-module\u002F\n├── README.md       # Usage documentation\n├── main.tf         # Primary resources\n├── variables.tf    # Typed inputs with descriptions\n├── outputs.tf      # Output values\n├── versions.tf     # required_version + required_providers\n├── examples\u002F\n│   ├── minimal\u002F\n│   └── complete\u002F\n└── tests\u002F\n    └── module_test.tftest.hcl   # or Go for Terratest\n```\n\n**Variable contracts**: always `description`, always explicit `type`, use `validation` for complex constraints, use `sensitive = true` for secrets, prefer `optional()` with typed defaults (1.3+) over untyped `map(any)`.\n\n**Output contracts**: always `description`, mark sensitive outputs, expose stable subsets (not whole provider objects).\n\nSee [Module Patterns](references\u002Fmodule-patterns.md) for the full contract patterns, module release checklist, and LLM-mistake checklist.\n\n## CI\u002FCD\n\nPipeline stages: **validate** → **test** → **plan** → **apply** (with environment protection).\n\nCost control: mock providers on PR validation, real-cloud integration only on main or scheduled, tag test resources, auto-cleanup.\n\nDrift prevention: pin runtime and providers, commit `.terraform.lock.hcl`, apply the **reviewed plan artifact** from the plan stage (do not re-run `plan` inside the apply job), run policy\u002Fsecurity stage on every path to apply.\n\nSee [CI\u002FCD Workflows](references\u002Fci-cd-workflows.md) for GitHub Actions, GitLab CI, and Atlantis templates plus the LLM-mistake checklist.\n\n## Security & Compliance\n\n**Essential checks:**\n\n```bash\ntrivy config .\ncheckov -d .\n```\n\n**Don't:** store secrets in variables or `.tfvars`, use default VPC, skip encryption, open security groups to `0.0.0.0\u002F0`, use inline `ingress`\u002F`egress` blocks in `aws_security_group`.\n\n**Do:** source secrets from a cloud secret manager (AWS Secrets Manager \u002F Azure Key Vault \u002F GCP Secret Manager) or use `write_only` arguments on 1.11+, create dedicated VPCs, enforce encryption at rest and TLS, least-privilege SGs, use separate `aws_vpc_security_group_{ingress,egress}_rule` resources (e.g. AWS provider v5+).\n\nMarking a variable `sensitive = true` masks display only — the value still lives in state. Use `write_only` \u002F `*_wo` on 1.11+, or keep secret material out of Terraform entirely via runtime lookups.\n\nSee [Security & Compliance](references\u002Fsecurity-compliance.md) for trivy\u002Fcheckov pipelines, state-file hardening, compliance mappings, and the LLM-mistake checklist.\n\n## State Management\n\n**Never use local state in teams or production.** Remote backends provide automatic locking, encryption, versioning, audit logging, and safe collaboration.\n\n### Choosing a Remote Backend\n\nAWS example (Azure `azurerm` \u002F GCP `gcs` \u002F TF Cloud syntax: see [State Management: Choosing a Remote Backend](references\u002Fstate-management.md#choosing-a-remote-backend)):\n\n```hcl\nterraform {\n  backend \"s3\" {\n    bucket        = \"my-terraform-state\"\n    key           = \"prod\u002Fvpc\u002Fterraform.tfstate\"\n    region        = \"us-east-1\"\n    encrypt       = true\n    use_lockfile  = true   # Native S3 locking, 1.10+\n  }\n}\n```\n\nOn Terraform \u003C 1.10, use `dynamodb_table = \"terraform-state-lock\"` instead of `use_lockfile`. Azure Storage, GCS, and Terraform Cloud all offer built-in locking - see the State Management reference for syntax. For choosing among backends and their locking models, see [Choosing a Remote Backend](references\u002Fstate-management.md#choosing-a-remote-backend).\n\n### State Organization\n\n| Pattern | Use When | Example Path |\n|---------|----------|--------------|\n| **Per environment** | Different teams per env | `prod\u002Fterraform.tfstate`, `staging\u002F...` |\n| **Per component** | Independent lifecycles | `prod\u002Fvpc\u002F`, `prod\u002Feks\u002F`, `prod\u002Frds\u002F` |\n| **Hybrid** (recommended) | Both benefits | `prod\u002Fnetworking\u002F`, `prod\u002Fcompute\u002F`, `staging\u002Fnetworking\u002F` |\n\nSplit state when: different teams, different update cadences, or >500 resources. Combine when: tightly coupled resources, \u003C100 resources, same lifecycle.\n\nSee [State Management](references\u002Fstate-management.md) for locking, migration, multi-team isolation, disaster recovery, and the LLM-mistake checklist.\n\n## Version Management\n\n| Component | Strategy | Example |\n|-----------|----------|---------|\n| Terraform runtime | Pin minor | `required_version = \"~> 1.9\"` |\n| Providers | Pin major | `version = \"~> 5.0\"` |\n| Modules (prod) | Pin exact | `version = \"5.1.2\"` |\n| Modules (dev) | Allow patch | `version = \"~> 5.1\"` |\n\nCommit `.terraform.lock.hcl` intentionally. Keep provider\u002Fruntime upgrades in a separate PR from functional changes. See [Code Patterns: Version Management](references\u002Fcode-patterns.md#version-management) for constraint syntax and upgrade workflow.\n\n## Modern Terraform Features (1.0+)\n\n| Feature | Min version | Common use |\n|---------|-------------|------------|\n| `try()` | 0.13+ | Safe fallbacks, replaces `element(concat())` |\n| `nullable = false` | 1.1+ | Prevent `null` silently overriding defaults |\n| `moved` blocks | 1.1+ | Refactor without destroy\u002Frecreate |\n| `optional()` with defaults | 1.3+ | Typed object attributes |\n| `import` blocks | 1.5+ | Declarative imports, reviewable in VCS |\n| `check` blocks | 1.5+ | Runtime assertions |\n| Native `terraform test` | 1.6+ | Built-in test framework |\n| Mock providers | 1.7+ | Cost-free unit testing |\n| `removed` blocks | 1.7+ | Declarative resource removal |\n| Provider-defined functions | 1.8+ | Provider-specific transformations (requires provider to declare functions) |\n| Cross-variable validation | 1.9+ | Reference other `var.*` in `validation` blocks |\n| `write_only` arguments | 1.11+ | Secrets never stored in state |\n| S3 native lock-file | 1.10+ | State locking without DynamoDB |\n\nBefore emitting a feature, verify the runtime floor. See [Code Patterns: Feature Guard Table](references\u002Fcode-patterns.md#feature-guard-table--version-floor--common-llm-errors) for the full table with common LLM error patterns per feature.\n\n## Runtime-Specific Guidance\n\n- **Terraform 1.0-1.5 (OpenTofu starts at 1.6)**: Terratest for integration, static analysis + plan validation only (no native tests).\n- **1.6+**: native `terraform test` \u002F `tofu test` available — migrate simple unit tests, keep Terratest for complex integration.\n- **1.7+**: mock providers cut test cost — mock for unit tests, real runs for final integration.\n- **1.10+**: S3 native lock-file (`use_lockfile`) is the correct default for new configurations — DynamoDB locking is no longer required.\n- **1.11+**: `write_only` arguments for secret handling keep credentials out of state.\n- **Terraform vs OpenTofu**: both supported. For licensing, governance, and feature delta, see [Quick Reference: Terraform vs OpenTofu](references\u002Fquick-reference.md#terraform-vs-opentofu-comparison).\n\n## Code Intelligence (terraform-ls)\n\nSemantic navigation for HCL. terraform-ls is optional; without it every row below degrades to a disclosed `rg` + Read fallback.\n\nSelf-contained terraform-ls layer of a generic code-intelligence discipline - apply the rows below directly. Recommended companion: the `code-intelligence` plugin (same `antonbabenko\u002Fagent-plugins` marketplace) carries the generic discipline (position anchoring, degradation gate, disclosure format, anti-phantom-shim) and ships `\u002Fcode-intelligence:doctor` for readiness. If it is installed, defer to its generic protocol; this skill stays fully self-contained without it.\n\n| Goal | Use | Tradeoff |\n|------|-----|----------|\n| Find definition \u002F all references | terraform-ls `goToDefinition` \u002F `findReferences` | Needs `init` + a position anchor |\n| Rename value symbol (var\u002Flocal\u002Foutput\u002Fprovider alias) | Manual: `findReferences` -> per-file fresh Read -> edit -> `validate` | No rename provider |\n| Rename resource\u002Fmodule address | `moved` block + `plan` shows 0 destroy | Text rename forces destroy\u002Frecreate |\n| Exact text \u002F known name \u002F `.tfvars` \u002F non-HCL | `rg` + Read | No semantic scope |\n\n✅ Supported: `goToDefinition`, `findReferences`, `documentSymbol`, `hover`, `workspaceSymbol`.\n❌ Unsupported: `goToImplementation`, call hierarchy, rename provider. Do not call these then report their absence as a finding.\n\n- ✅ Prereq: local `terraform`\u002F`tofu` on PATH, `terraform init` run; cold start may need one retry.\n- ✅ LSP calls are position-anchored (`file:line:character`) - anchor with `rg` first, never symbol-name-only.\n- ❌ Do not claim \"LSP broken, using rg\" until the [Degradation Gate](references\u002Fcode-intelligence-lsp.md#degradation-gate) passes; disclose any tool substitution on the first line.\n\nDepth: [Code Intelligence](references\u002Fcode-intelligence-lsp.md#terraform-ls-capability-matrix).\n\n## Reference Files\n\nProgressive disclosure — essentials here, depth on demand:\n\n- [Testing Frameworks](references\u002Ftesting-frameworks.md) — static analysis, native tests, Terratest, mock providers\n- [Module Patterns](references\u002Fmodule-patterns.md) — structure, variable\u002Foutput contracts, `terraform_remote_state` rules, release checklist\n- [CI\u002FCD Workflows](references\u002Fci-cd-workflows.md) — GitHub Actions, GitLab CI, Atlantis, cost control\n- [Security & Compliance](references\u002Fsecurity-compliance.md) — trivy\u002Fcheckov, secrets handling, compliance mappings\n- [State Management](references\u002Fstate-management.md) — backends, locking, migration, multi-team, recovery\n- [Code Patterns](references\u002Fcode-patterns.md) — block ordering, `count`\u002F`for_each` deep dive, modern features, version management, locals\n- [Code Intelligence](references\u002Fcode-intelligence-lsp.md) - terraform-ls capabilities, position-anchored calls, manual rename, degradation gate\n- [Quick Reference](references\u002Fquick-reference.md) — command cheat sheets, flowcharts, troubleshooting\n\n## License\n\nApache License 2.0. See LICENSE for full terms.\n\n**Copyright © 2026 Anton Babenko**\n",{"name":5,"license":15,"metadata":55,"description":7},{"author":56,"version":57},"Anton Babenko","1.17.1","main","31d8a5248f835da39c0bc0626acec19582bf6173","home\u002F.agents\u002Fskills\u002Fterraform-skill","https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles","https:\u002F\u002Fgithub.com\u002Fm0hill","2026-10-26 17:09:42",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add m0hill\u002Fdotfiles --skill terraform-skill",{"tool":70,"command":71},"bunx","bunx skills add m0hill\u002Fdotfiles --skill terraform-skill",{"tool":73,"command":74},"pnpm","pnpm dlx skills add m0hill\u002Fdotfiles --skill terraform-skill","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002FSKILL.md",true,[78,84,88,92,96,100,104,108,112,116,120,124,128,132],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"_meta.json","REFERENCE","参考文档",133,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fnear-cli-tools\u002F_meta.json",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"package.json",720,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fnear-cli-tools\u002Fpackage.json",{"path":89,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":90,"sourceHtmlUrl":91},"README.md",4750,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fnear-cli-tools\u002FREADME.md",{"path":93,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fci-cd-workflows.md",14164,"https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002Freferences\u002Fci-cd-workflows.md",{"path":97,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fcode-intelligence-lsp.md",6796,"https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002Freferences\u002Fcode-intelligence-lsp.md",{"path":101,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fcode-patterns.md",31631,"https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002Freferences\u002Fcode-patterns.md",{"path":105,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fmodule-patterns.md",23460,"https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002Freferences\u002Fmodule-patterns.md",{"path":109,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fquick-reference.md",19886,"https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002Freferences\u002Fquick-reference.md",{"path":113,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fsecurity-compliance.md",19094,"https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002Freferences\u002Fsecurity-compliance.md",{"path":117,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":118,"sourceHtmlUrl":119},"references\u002Fstate-management.md",46160,"https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002Freferences\u002Fstate-management.md",{"path":121,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Ftesting-frameworks.md",13989,"https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fterraform-skill\u002Freferences\u002Ftesting-frameworks.md",{"path":125,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":126,"sourceHtmlUrl":127},"skill-card.md",2101,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fnear-cli-tools\u002Fskill-card.md",{"path":129,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":130,"sourceHtmlUrl":131},"SOURCE.md",256,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fnear-cli-tools\u002FSOURCE.md",{"path":133,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":134,"sourceHtmlUrl":135},"TRUST.auto.yaml",2354,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fnear-cli-tools\u002FTRUST.auto.yaml",[137,148],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":141,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":50},"01M6CBGD5D5XM86G0JTDRG0HH7","ponytail","Lazy senior dev mode: solve the whole task with the smallest clear change. Levels: lite, full (default), ultra.","MIT","https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002Fhome\u002F.agents\u002Fskills\u002Fponytail\u002FSKILL.md",[],[139,145,146,147],"solve","dev","change",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":141,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":157,"publishedAt":50},"01M6CBEJV6CQE21GAK8ZF53Y7W","typesafe-ai","Build AI-powered software with TypeSafe: small units of AI intelligence you can use like programming primitives. Its System One models, including Jev, turn natural language and application state into typed judgments and probabilities that code can combine. Use when a feature needs programmable common sense, when brainstorming what AI could make possible in an app, or when an LLM prompt-and-parse step could become a structured decision. Applications include routing, ranking, extraction, verification, and interactive experiences; these are starting points, not the limits. Read live docs and cookbooks to find useful patterns and discover new combinations.","https:\u002F\u002Fgithub.com\u002Fm0hill\u002Fdotfiles\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftypesafe-ai\u002FSKILL.md",[154],{"categoryNo":155,"categoryName":156,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师",[158,159,160,47,161,162,163,164,165,166,167,168,169,170,171,172,41,173,174,175],"typesafe ai","find","models","primitives","jev","interactive","read","prompt","docs","programming","common","decision","system","applications","verification","code","routing","brainstorming"]