Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add first-fluke/fullstack-starter --skill oma-tf-infragit clone --depth 1 https://github.com/first-fluke/fullstack-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/first-fluke/fullstack-starter/oma-tf-infra)<a href="https://agentmods.dev/skills/first-fluke/fullstack-starter/oma-tf-infra"><img src="https://agentmods.dev/badge/skills/first-fluke/fullstack-starter/oma-tf-infra/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/first-fluke/fullstack-starter/oma-tf-infra"><img src="https://agentmods.dev/badge/skills/first-fluke/fullstack-starter/oma-tf-infra.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.02535 |
| Opus 5.5 | $0.00012 | $0.01014 |
| Sonnet 5.5 | $0.00006 | $0.00507 |
| Haiku 4.5 | $0.00003 | $0.00253 |
Grade A, and why
oma-tf-infra scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to oma-tf-infra — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 200 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TF Infra Agent - Infrastructure-as-Code Specialist
Scheduling
Goal
Design, implement, review, and document Terraform-based infrastructure across cloud providers with secure state, least privilege, cost awareness, continuity, and policy/testing controls.
Intent signature
- User asks for Terraform, IaC, cloud provisioning, state, IAM/OIDC, networking, storage, compute, databases, CDN, policy-as-code, cost optimization, drift, or terraform plan review.
- User needs infrastructure controls for AI systems, continuity, or architecture documentation.
When to use
- Provisioning infrastructure on any cloud provider (AWS, GCP, Azure, OCI)
- Creating or modifying Terraform configurations for compute, databases, storage, networking
- Configuring CI/CD authentication (OIDC, workload identity, IAM roles)
- Setting up CDN, load balancers, object storage, message queues
- Reviewing terraform plan output before apply
- Troubleshooting Terraform state or resource issues
- Migrating from manual console changes to Terraform
- Implementing infrastructure controls for AI systems (ISO/IEC 42001)
- Designing continuity-oriented infrastructure (ISO 22301)
- Producing architecture documentation (ISO/IEC/IEEE 42010)
When NOT to use
- Database schema design or query tuning -> use DB Agent
- Backend API implementation -> use Backend Agent
- CI/CD pipeline code (non-infrastructure) -> use Dev Workflow
- Security/compliance audit -> use QA Agent
Expected inputs
- Cloud provider, environment, Terraform scope, desired resources, and state/backend context
- Existing
.tf,.tfvars, modules, provider versions, CI/CD auth, plan output, or drift symptoms - Security, cost, continuity, policy, tagging, and documentation constraints
Expected outputs
- Terraform code, module changes, review findings, plan analysis, or architecture/control documentation
- Validation, formatting, plan, and policy/security scan results when applicable
- Explicit risks around state, secrets, drift, destructive changes, and cost
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -11 lines · -57 tokens per session 003dd834921b
- 1mo ago First seen · 211 lines · 87 tokens per session scan A c0a8943f42f5
oma-tf-infra is a skill published in the GitHub repository first-fluke/fullstack-starter (224 stars, last pushed 2d ago), licensed MIT. It adds 30 tokens to every session and 2,535 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to oma-tf-infra, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
deploy-release
Prepare and verify a staged or production deployment with rollback and smoke checks.
system-design-building-blocks
Select infrastructure components by the constraint each removes: load balancers, caches and invalidation, queues and pub/sub, CDN, API gateway, rate limiting, consistent hashing. Use when choosing cache, queue, replica, or edge layers; defer engine tuning to the database category.
aws-iam
Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and baseline policy generation from application source…
aws-incident-response
Investigate AWS credential compromise, STS session abuse, and API breaches; produce an evidence-backed timeline, containment plan, and incident handoff.
terradart
Write TerraDart infrastructure code (Dart that synthesizes Terraform JSON). Use when a task mentions TerraDart, a Dart Stack, terradartgoogle / terradartaws / terradartcloudflare / terradartappwrite / terradartgooglebeta, or translating Terraform (.tf) into Dart.
frontend-feature
Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.