Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lukasrepublic/agentic-foundry --skill opentofu-aws-modulesgit clone --depth 1 https://github.com/lukasrepublic/agentic-foundryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lukasrepublic/agentic-foundry/opentofu-aws-modules)<a href="https://agentmods.dev/skills/lukasrepublic/agentic-foundry/opentofu-aws-modules"><img src="https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/opentofu-aws-modules.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01578 |
| Opus 5 | $0.00000 | $0.00789 |
| Sonnet 5 | $0.00000 | $0.00316 |
| Haiku 4.5 | $0.00000 | $0.00158 |
Grade A, and why
opentofu-aws-modules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When to trigger
- Authoring or modifying an OpenTofu/Terraform module or an env-scoped root in the IaC repo.
- Adding, changing, or removing an AWS resource declaration.
- Changes to state-backend configuration.
- Authoring or modifying env-scoped tfvars (per-environment value sets).
- A provider version bump affecting resource schemas.
- Secret-reference pattern decisions (a secret manager vs. a parameter store vs. an external-secrets path).
Procedure
-
Determine env scope: the target environment (or a shared/cross-env scope). Every module edit is env-scoped; never touch two environments in a single change unless the spec explicitly authorizes it. Default to the lowest environment first and promote upward.
-
Place the module: child modules under the IaC repo's reusable-module path (env-agnostic); root modules under the per-environment instantiation path. Read the existing directory layout and follow it before introducing new paths.
-
Naming convention: follow the IaC repo's documented resource-naming pattern (typically
<env>-<resource-type>-<purpose>). The formal naming spec lives in the IaC repo's conventions; match the pattern of existing resources rather than inventing a new one. -
Secret references: always resolve secrets through a
datasource against the secret manager or parameter store. Never declare secret values inline in.tffiles or*.tfvars. Thedata "<type>" "<name>" { name = var.secret_name }pattern is required; the secret name is an input variable, never hard-coded. -
Format, validate, plan: run the formatter (idempotent — always before committing), then the validator (catches schema errors), then the read-only plan in the env root being modified. The active profile's read-only plan command is
{{ profile.infra_binding.plan }}— run it to compute the change delta; do not invent a plan invocation. -
Plan output in the change record: for every environment-bound change, attach the full plan output to the change record / PR body under a
## Plan outputsection. The reviewer reads the plan before approving. This is mandatory.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 73 lines · 0 tokens per session scan A 6d72845c0289
opentofu-aws-modules is a skill published in the GitHub repository lukasrepublic/agentic-foundry (1 stars, last pushed 3d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,578 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
helm-scaffolding
Scaffolds Helm charts for SDD components, driven by component settings.
helm-standards
Standards for Helm charts in SDD projects, including settings-driven patterns.
cost-optimization
Optimize cloud costs across AWS, Azure, GCP, and OCI through resource rightsizing, tagging strategies, reserved instances, and spending analysis. Use when reducing cloud expenses, analyzing infrastructure costs, or implementing cost governance policies.
linkerd-patterns
Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.
spawn-reviewers
Spawn and collect the reviewer fleet at stage20spawnreviewers. Consumes spawn.json.spec (the authoritative spawn spec from derive-spawn-spec / derive-static-spec), resolves GRAPHPROJECT, builds per-agent prompts from the per-agent template + role suffixes (Bug Hunter A/B, Unified Auditor, Domain Critics, Impact…
design-inventory
Use to run the Claude Design to ClosedLoop pipeline against the current web-ui. Stage A inventories a design export zip into schema-validated findings (typed design units - screens, regions like nav bars, standalone components like a chat dialog; UX and behavioral changes; Storybook component reuse mapping; token…