Borrowing it
Nothing to install: this file belongs to nozomi-koborinai/terradart. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/nozomi-koborinai/terradart/main/.agents/skills/terradart-add-curated-resource/SKILL.mdgit clone --depth 1 https://github.com/nozomi-koborinai/terradartWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nozomi-koborinai/terradart/terradart-add-curated-resource)<a href="https://agentmods.dev/skills/nozomi-koborinai/terradart/terradart-add-curated-resource"><img src="https://agentmods.dev/badge/skills/nozomi-koborinai/terradart/terradart-add-curated-resource/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nozomi-koborinai/terradart/terradart-add-curated-resource"><img src="https://agentmods.dev/badge/skills/nozomi-koborinai/terradart/terradart-add-curated-resource.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 50 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.02361 |
| Opus 5.5 | $0.00020 | $0.00944 |
| Sonnet 5.5 | $0.00010 | $0.00472 |
| Haiku 4.5 | $0.00005 | $0.00236 |
Grade A, and why
terradart-add-curated-resource scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Add or update a curated Google resource
Read CONTEXT.md for vocabulary. Generation policy and pitfalls are in AGENTS.md. Do not hand-edit files under packages/terradart_google/lib/src/ — regenerate with terradart wrap.
Contents
Inputs
schema.jsonwith the target Terraform type (checked-in fixture or task-provided artifact).- Optional Magic Modules YAML when semantic hints help (see
tool/mm_yaml_sources.yaml). - Do not fetch schemas ad hoc or assume
terraformis installed in cloud-agent VMs unless the task provides it.
Workflow
Task progress:
- 1. Confirm the type exists in
schema.json. Note the exactgoogle_*key (do not infer from MM product file names). IAM adjuncts may be*_iam_member,*_iam_binding, or*_iam_policy. For binding/policy, setcuratedDocthat states authoritative / replace semantics (yaml_loader_test.dartenforces this). Prefer*_iam_memberin examples when an additive grant is enough. The adjunct's parent argument comes from- parents: iam-adjunctsintool/reference_targets.yaml(service: api.ref); a parent whose identity input the heuristic misses gets anidentity:entry there, not acustomSlotsoverride. Itsmember/membersare typedIamPrincipalby- principals: IamPrincipal; examples passsa.principalor.user(...)/.group(...), never auser:string. - 2. Manifest: add or update one row in
tool/mm_yaml_sources.yaml(upstreampath ornullwith reason). Every curated override must have a manifest entry. - 3. MM fixture (when
upstreamis set): rundart tool/sync_mm_yaml.dartfor that type only if you intend to consume new MM hints in this PR. - 4. New resource only: scaffold with
terradart wrap-init(skip when editing an existing override — including one the weekly schema bump already scaffolded; itstool/curation_backlog.yamlnote says so). - 5. Edit
packages/terradart_codegen/lib/src/codegen/wrapper_overrides/yaml/<terraform_type>.yaml— keep it thin (human API decisions only). - 5b. New barrel? Add its entry to
packages/terradart_codegen/lib/src/codegen/barrels/barrels.yaml(doc:required;file:/extraExports:only when needed). Barrel files underterradart_google/lib/are generated bywrapfrom the catalog — never hand-edit them;wrapfails closed on a catalog barrel with no manifest entry. - 6. Lint:
cd packages/terradart_codegen && dart run bin/terradart.dart lint-override(must exit 0). Amigrate-shape-underivablefinding means the migration manifest cannot derive apreludehelper or custom slot (#659): reshape the helper to a field-per-keyencode()map literal, declarecustomSlots.<slot>.migrate: {kind: manual, reason: ...}when the slot is manual by design, or add a reasonedtool/migrate_manifest_debt.yamlentry — the last two are maintainer decisions, outside the Wave scope ledger. - 7. Regenerate:
dart run bin/terradart.dart wrap --only <terraform_type> ...for the wrapper, then a fullwrapwith--migrate-manifest— the migration manifest (packages/terradart_migrate/lib/src/manifest/google.g.dart) is a whole-registry artifact that--onlyskips, every curated factory adds aMigrateEntryto it, and thewrap --checklane fails while it is stale — thenwrap --checkagainst the fixture paths inAGENTS.mdUseful Commands. - 8. Review the generated
terradart_googlediff (constructors, enums, sealed types, sensitive fields, barrel export). - 9. Counts: if catalog size changed, update
tool/doc_expectations.dart,catalog_count_test.dart, andwrap_command_test.dartfile-count assertions in the same PR. - 10. Wave / example: if this resource is part of a Wave release, follow
terradart-ship-wave. For new*IamBinding/*IamPolicywhen the sibling*IamMemberis already curated and in quickstart synth, prefertool/example_debt.yamlwithiam-adjunct-debt:over extending examples; otherwise add or extend a quickstart.curatedDocalone is not enough. - 10b. Gated example check: if applying the new type needs an organization, an entitlement or real external inputs, bills while it exists, or leaves behind something that cannot be deleted (or a name that stays reserved), its example must be a gated example (README
## Before you applysection — seeAGENTS.mdExample verification). Extend the product's gated example or add one; never put such a factory into an example without that section. Cost or apply-ability is never a reason fortool/example_debt.yaml. - 11. Verify: run the
terradart-agent-verifyworkflow (tool/agent_verify.sh; add--maintainerwhen touching wrap-init / wrap-promote).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago Changed · +1 lines 132ced9674bd
- 1mo ago Changed e760fd889999
- 1mo ago Changed c9ae84fb0382
- 1mo ago Changed · +1 lines 8208468d8767
- 1mo ago Changed · -2 lines 235f2f60dad3
- 2mo ago First seen · 79 lines · 50 tokens per session scan A dc36522bd6e3
terradart-add-curated-resource is a skill published in the GitHub repository nozomi-koborinai/terradart (52 stars, last pushed today), licensed Apache-2.0. It adds 50 tokens to every session and 2,361 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
terraform-infrastructure-as-code
Comprehensive Terraform Infrastructure as Code skill covering resources, modules, state management, workspaces, providers, and advanced patterns for cloud-agnostic infrastructure deployment.
Terraform Infrastructure as Code
Production-grade Terraform development with HCL best practices, module design, state management, multi-cloud patterns, and AI-enhanced infrastructure as code for scalable cloud deployments.
auditing-terraform-infrastructure-for-security
Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.
terraform-expert
Expert-level Terraform infrastructure as code, modules, state management, and production best practices. Use when the user mentions infrastructure as code, devops, or automation, or when the task involves Terraform Basics, Resource Management, Modules, or State Management.
auditing-terraform-infrastructure-for-security
Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.
terraform-docs
Terraform 1.15.x — configuration language, resources, variables, modules, state, backends, providers, functions.