Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add niels-emmer/myace --skill iac-security-checklistgit clone --depth 1 https://github.com/niels-emmer/myaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/niels-emmer/myace/iac-security-checklist)<a href="https://agentmods.dev/skills/niels-emmer/myace/iac-security-checklist"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/iac-security-checklist/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/niels-emmer/myace/iac-security-checklist"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/iac-security-checklist.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.00665 |
| Opus 5 | $0.00018 | $0.00332 |
| Sonnet 5 | $0.00007 | $0.00133 |
| Haiku 4.5 | $0.00004 | $0.00067 |
Grade A, and why
IaC Security Checklist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
A fast, consistent pass over an infrastructure change to catch the invariant violations that are easy to miss in a large plan or diff — before it ever reaches the point of asking a human to approve an apply. This is a gate before that request, not a substitute for it.
When to use it
Run this against every nontrivial IaC change (new resources, modified network/identity/access configuration) before handing it off for review or requesting apply approval. For a trivial change (a tag fix, a variable rename with no resource impact), a quick skim is enough — don't perform ceremony for its own sake.
Checklist
Mark each item PASS, FAIL, or N/A. Every FAIL needs either a fix or a documented exception (see the exception-documentation skill) before the change moves forward.
Network exposure
- No resource has a public IP, public endpoint, or
0.0.0.0/0-equivalent ingress rule unless it's a documented exception. - Any newly-public surface is scoped as narrowly as possible (specific ports, specific source ranges) rather than wide-open.
- Inter-service traffic that could stay on a private network/VPC/VNet does.
Identity and secrets
- Service-to-service auth uses managed/workload identity wherever the provider supports it, not a static key or connection string.
- No plaintext secret, API key, connection string, or credential appears in any
.tf/.bicep/template file, in a committed tfvars/parameter file, or hardcoded in a module default. - Any secret that must exist is stored in the provider's secret manager (or equivalent), referenced by reference/ID in code — not embedded as a literal value.
- Newly-granted permissions (IAM roles, RBAC assignments) are scoped to what the workload actually needs, not a broad built-in admin/owner role taken as a shortcut.
State protection
- State is stored in a remote backend with locking enabled — not local state — for anything beyond a personal sandbox.
- The state backend itself is access-restricted (not broadly readable), since state can contain sensitive values in plaintext.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 47 lines · 36 tokens per session scan A 55bb50594be2
IaC Security Checklist is a skill published in the GitHub repository niels-emmer/myace (1 stars, last pushed 5d ago), licensed MIT. It adds 36 tokens to every session and 665 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
html-draft
Use when user wants a standalone HTML diagram in flat engineering blueprint style — architecture diagrams, system flows, technical spec sheets, component maps. Generates one HTML file using Tailwind v4 (browser CDN) for layout and D3 v7 (CDN) for SVG diagrams. User-invoked only — do NOT auto-trigger. Triggers on…
idea
Use when capturing ONE new idea the user voices and wants recorded — "save this idea", "I have an idea", "log this idea", "/idea", "idea: ...". Creates a provenance-tracked folder (one folder per idea) in your ideas repo, dedups against an index, optionally mirrors to a GitHub Project view filtered by label:idea. NOT…
pm-feedback
A feedback-analysis aid that turns spreadsheet data, CSV files, pasted text, or review screenshots into organized product insights. It groups themes, identifies sentiment, examines trends and sources, calculates NPS, and extracts user types.
weekly-planning
A planning workflow that turns a completed weekly review and existing backlog into prioritized outcomes for one ISO calendar week.
gh-issues
Use when creating, searching, updating, or managing GitHub issues via CLI. Triggers: "issue", "create issue", "gh issue", "task tracking", "context", "handoff", "resume task", "session context", "save progress", "active tasks", "in-progress", "my tasks", "open issues". Covers: gh commands, bulk operations, JSON/jq…
pm-brainstorm
A structured brainstorming session for exploring a specific product problem or opportunity and narrowing the results to ideas worth pursuing.