Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/first-fluke/fullstack-starter/oma-tf-infranpx skills add first-fluke/fullstack-starter --skill oma-tf-infragit clone --depth 1 https://github.com/first-fluke/fullstack-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/first-fluke/fullstack-starter/oma-tf-infra)<a href="https://agentmods.dev/skills/first-fluke/fullstack-starter/oma-tf-infra"><img src="https://agentmods.dev/badge/skills/first-fluke/fullstack-starter/oma-tf-infra.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00087 | $0.02707 |
| Opus 5 | $0.00044 | $0.01354 |
| Sonnet 5 | $0.00017 | $0.00541 |
| Haiku 4.5 | $0.00009 | $0.00271 |
Grade A, and why
oma-tf-infra scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to oma-tf-infra — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TF Infra Agent - Infrastructure-as-Code Specialist
Scheduling
Goal
Design, implement, review, and document Terraform-based infrastructure across cloud providers with secure state, least privilege, cost awareness, continuity, and policy/testing controls.
Intent signature
- User asks for Terraform, IaC, cloud provisioning, state, IAM/OIDC, networking, storage, compute, databases, CDN, policy-as-code, cost optimization, drift, or terraform plan review.
- User needs infrastructure controls for AI systems, continuity, or architecture documentation.
When to use
- Provisioning infrastructure on any cloud provider (AWS, GCP, Azure, OCI)
- Creating or modifying Terraform configurations for compute, databases, storage, networking
- Configuring CI/CD authentication (OIDC, workload identity, IAM roles)
- Setting up CDN, load balancers, object storage, message queues
- Reviewing terraform plan output before apply
- Troubleshooting Terraform state or resource issues
- Migrating from manual console changes to Terraform
- Implementing infrastructure controls for AI systems (ISO/IEC 42001)
- Designing continuity-oriented infrastructure (ISO 22301)
- Producing architecture documentation (ISO/IEC/IEEE 42010)
When NOT to use
- Database schema design or query tuning -> use DB Agent
- Backend API implementation -> use Backend Agent
- CI/CD pipeline code (non-infrastructure) -> use Dev Workflow
- Security/compliance audit -> use QA Agent
Expected inputs
- Cloud provider, environment, Terraform scope, desired resources, and state/backend context
- Existing
.tf,.tfvars, modules, provider versions, CI/CD auth, plan output, or drift symptoms - Security, cost, continuity, policy, tagging, and documentation constraints
Expected outputs
- Terraform code, module changes, review findings, plan analysis, or architecture/control documentation
- Validation, formatting, plan, and policy/security scan results when applicable
- Explicit risks around state, secrets, drift, destructive changes, and cost
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 211 lines · 87 tokens per session scan A c0a8943f42f5
oma-tf-infra is a skill published in the GitHub repository first-fluke/fullstack-starter (222 stars, last pushed today), licensed MIT. It adds 87 tokens to every session and 2,707 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to oma-tf-infra, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
terradart-add-curated-resource
Add or update a curated Google Cloud factory via terradart wrap (schema.json, optional MM YAML, wrapper override, lint, regenerate). Use when extending terradartgoogle with a new google resource.
terradart-add-beta-resource
Add a beta-only curated factory to terradartgooglebeta (filtered-fixture extraction, googlebeta override, wrap with provider pin). Use when a later provider pin introduces a new beta-only google type — the current pin's beta-only catalog is filled.
terradart-backfill-examples
Backfill example quickstarts for curated factories listed in tool/exampledebt.yaml — extend stacks, sync debt, and run terraform validate locally before PR.
terradart-tighten-example-topology
After example backfill, wire orphan factories into sibling refs (SSL certs on proxies, health checks on backends) and run topology + terraform validate gates.
trigger-cost-savings
Analyze Trigger.dev tasks, schedules, and runs for cost optimization opportunities. Use when asked to reduce spend, optimize costs, audit usage, right-size machines, or review task efficiency. Combines static source analysis with live run analysis via the Trigger.dev MCP tools (listruns, getrundetails…
frontend-feature
Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.