Agent skill

Terrashark

by LukasNiessen in LukasNiessen/terrashark

Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps.

MITAuto-check passedDevOps & Cloud

Install Terrashark

skills CLI

$ npx skills add LukasNiessen/terrashark --skill terrashark -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install LukasNiessen/terrashark terrashark --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "terrashark" agent skill from https://github.com/LukasNiessen/terrashark/tree/main into .claude/skills/terrashark/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "terrashark", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add LukasNiessen/terrashark --skill terrashark -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install LukasNiessen/terrashark terrashark --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "terrashark" agent skill from https://github.com/LukasNiessen/terrashark/tree/main into .agents/skills/terrashark/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "terrashark", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add LukasNiessen/terrashark --skill terrashark -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install LukasNiessen/terrashark terrashark --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "terrashark" agent skill from https://github.com/LukasNiessen/terrashark/tree/main into .cursor/skills/terrashark/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "terrashark", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add LukasNiessen/terrashark --skill terrashark -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install LukasNiessen/terrashark terrashark --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "terrashark" agent skill from https://github.com/LukasNiessen/terrashark/tree/main into .gemini/skills/terrashark/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "terrashark", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install LukasNiessen/terrashark terrashark

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add LukasNiessen/terrashark --skill terrashark -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "terrashark" agent skill from https://github.com/LukasNiessen/terrashark/tree/main into .github/skills/terrashark/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "terrashark", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add LukasNiessen/terrashark --skill terrashark -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install LukasNiessen/terrashark terrashark --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "terrashark" agent skill from https://github.com/LukasNiessen/terrashark/tree/main into .opencode/skills/terrashark/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "terrashark", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: terrashark
GitHub stars: 716
Token cost: ~843 tokens
SKILL.md length: 322 words
Files: 85 (incl. references, assets)
Skills in repo: 1
Repo updated: Oct 2, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps.

Works in 7 steps: Capture execution context → Diagnose likely failure mode(s) → Load only the relevant reference file(s) → …
Migrating IaC and when building delivery/testing pipelines
SKILL.md covers 1) Capture execution context, 2) Diagnose likely failure…, 3) Load only the relevant… and 4) Propose fix path with…, plus 3 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Terrashark is an agent skill from LukasNiessen/terrashark. Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines.

Its SKILL.md is about 840 tokens, which your agent loads only when the skill is triggered. The skill folder holds 88 other files, including reference files and assets (for example `.claude-plugin/marketplace.json`, `.claude/settings.local.json` and `.github/FUNDING.yml`).

It sits in DevOps & Cloud, covering Infrastructure as code. It works with Terraform, Amazon Web Services, Google Cloud and Microsoft Azure. The repository describes itself as: Terraform Skill for Claude Code and Codex. LLMs hallucinate a lot with Terraform - TerraShark fixes this. It eliminates hallucinations, is designed for modular and secure code… The licence is MIT.

When your agent uses it

Migrating IaC and when building delivery/testing pipelines
Tasks that involve Infrastructure as code

Example prompts

“/terrashark”

Workflow steps

7 steps, taken from the step headings in SKILL.md.

Capture execution context
Diagnose likely failure mode(s)
Load only the relevant reference file(s)
Propose fix path with explicit risk controls
Generate implementation artifacts
Validate before finalize
Output contract

What it can do on your machine

Read from SKILL.md and the folder at commit 21f2c18. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Terrashark loads about 843 tokens when it runs, and up to ~16k if it reads all its reference files. Until then it costs about 73 tokens; SKILL.md has 322 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~73
When it runs · the whole SKILL.md, loaded when a task matches: ~843
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~16k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from LukasNiessen/terrashark at commit 21f2c18, republished under its MIT licence (© LukasNiessen). 322 words, ~843 tokens.

Download SKILL.mdSave it as .claude/skills/terrashark/SKILL.md (or your agent's skills folder). This skill also uses 84 other files; get the full folder from GitHub.

name: terrashark
description: Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines.

Terrashark: Failure-Mode Workflow for Terraform/OpenTofu

Run this workflow top to bottom.

1) Capture execution context

Record before writing code:

runtime (terraform or tofu) and exact version
provider(s), target platform, and state backend
execution path (local CLI, CI, HCP Terraform/TFE, Atlantis)
environment criticality (dev/shared/prod)

If unknown, state assumptions explicitly.

2) Diagnose likely failure mode(s)

Select one or more based on user intent and risk:

identity churn: resource addressing instability, refactor breakage
secret exposure: secrets in state, logs, defaults, artifacts
blast radius: oversized stacks, weak boundaries, unsafe applies
CI drift: version mismatch, unreviewed applies, missing artifacts
compliance gate gaps: missing policies/approvals/audit controls

3) Load only the relevant reference file(s)

Primary references:

references/identity-churn.md
references/secret-exposure.md
references/blast-radius.md
references/ci-drift.md
references/compliance-gates.md

Supplemental references (only when needed):

references/testing-matrix.md
references/quick-ops.md
references/examples-good.md
references/examples-bad.md
references/examples-neutral.md
references/coding-standards.md
references/module-architecture.md
references/ci-delivery-patterns.md
references/security-and-governance.md
references/do-dont-patterns.md
references/mcp-integration.md

Conditional references (CRR; load only on detected signals):

references/conditional/backend-state-safety.md (backend is s3, azurerm, gcs, remote, cloud, pg, consul, or local, or task mentions backend migration, locking, state backup, or restore)
references/conditional/trusted-modules.md (provider is aws, azurerm, google, oci, or ibm)

Do not load multiple conditional references unless the task spans multiple detected backends, providers, or tools.

4) Propose fix path with explicit risk controls

For each fix, include:

why this addresses the failure mode
what could still go wrong
guardrails (tests, approvals, rollback)

5) Generate implementation artifacts

When applicable, output:

HCL changes (typed vars, stable keys, bounded versions)
migration blocks (moved, import strategy)
CI pipeline updates (plan/apply separation, artifacts, policy checks)
compliance controls (approvals, policy rules, evidence paths)

When a trusted registry module covers the requested resource and the user has not asked for raw HCL, default to that module with an exact version pin (see references/conditional/trusted-modules.md).

6) Validate before finalize

Always provide command sequence tailored to runtime and risk tier. Never recommend direct production apply without reviewed plan and approval.

7) Output contract

Return:

assumptions and version floor
selected failure mode(s)
chosen remediation and tradeoffs
validation/test plan
rollback/recovery notes for destructive-impact changes

Files

SKILL.md and 84 other files (references, assets) in the repository root of LukasNiessen/terrashark.

SKILL.md
.claude-plugin/marketplace.json
.claude/settings.local.json
.github/CODEOWNERS
.github/FUNDING.yml
.github/PULL_REQUEST_TEMPLATE.md
.github/dependabot.yml
.github/workflows/deploy-docs.yml
.github/workflows/stale.yml
.github/workflows/validate.yml
.gitignore
CHANGELOG.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
LICENSE
PHILOSOPHY.md
README.md
… and 68 more

Open the folder on GitHubat commit 21f2c18

Compare with similar skills

Terrashark next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Terrashark compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Terrashark this skillLukasNiessen/terrashark	716	—	~843	Automated safety check: Pass	MIT	8 days ago
Terravision Cloud Diagramspatrickchugh/terravision	1.6k	—	~5.6k	Automated safety check: Notes	AGPL-3.0-only	4 days ago
Provider Verificationmondoohq/mql	412	—	~3.7k	Automated safety check: Pass	Custom licence	today
Terraform Module Librarywshobson/agents	40k	11 repos	~1.3k	Automated safety check: Pass	MIT	6 days ago
Atmos Migrationcloudposse/atmos	1.4k	—	~5.1k	Automated safety check: Warn	Apache-2.0	today
Tsh Implementing Terraform ModulesTheSoftwareHouse/copilot-collections	284	—	~1.6k	Automated safety check: Pass	MIT	5 days ago

Similar skills

Terravision Cloud Diagrams
patrickchugh/terravision
Draw cloud architecture diagrams for AWS, Azure or GCP with the official provider icon sets, using TerraVision.
1.6k GitHub stars~5.6k tokensUpdated 4 days ago
DevOps & CloudAuto-check: notes
Provider Verification
mondoohq/mql
Verify mql provider resource/field changes against real cloud infrastructure.
412 GitHub stars~3.7k tokensUpdated today
DevOps & CloudAuto-check passed
Terraform Module Library
wshobson/agents
Build reusable, tested Terraform modules for AWS, Azure, GCP and OCI, with a standard file layout, an AWS VPC example, versioning rules and Terratest checks.
40k GitHub starsUsed in 11 repos~1.3k tokens
DevOps & CloudAuto-check passed
Atmos Migration
cloudposse/atmos
Migrate to Atmos from native Terraform, Terraform Workspaces, Terramate, Terragrunt, Make, Just, or Task; migrate tool versions from mise or Aqua CLI; migrate AWS/GCP/Azure CLI configs, Leapp…
1.4k GitHub stars~5.1k tokensUpdated today
DevOps & CloudAuto-check: warnings
Tsh Implementing Terraform Modules
TheSoftwareHouse/copilot-collections
Build reusable Terraform modules for AWS, Azure, and GCP infrastructure following infrastructure-as-code best practices.
284 GitHub stars~1.6k tokensUpdated 5 days ago
DevOps & CloudAuto-check passed
Cloud Architect
davila7/claude-code-templates
Expert cloud architect specializing in AWS/Azure/GCP multi-cloud infrastructure design, advanced IaC (Terraform/OpenTofu/CDK), FinOps cost optimization, and modern architectural patterns.
33k GitHub starsUsed in 8 repos~1.9k tokens
DevOps & CloudAuto-check passed

Works with

Questions about Terrashark

What does Terrashark do?

Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Terrashark is an agent skill from LukasNiessen/terrashark. Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps.

When should I use Terrashark?

Terrashark fits situations like: migrating IaC and when building delivery/testing pipelines; tasks that involve Infrastructure as code.

How do I install Terrashark in Claude Code?

Run `npx skills add LukasNiessen/terrashark --skill terrashark -a claude-code`. Or copy the skill folder (the LukasNiessen/terrashark repository) into .claude/skills/terrashark in your project. Claude Code loads it when a task matches its description.

How do I install Terrashark in Codex?

Run `npx skills add LukasNiessen/terrashark --skill terrashark -a codex`. Or copy the skill folder (the LukasNiessen/terrashark repository) into .agents/skills/terrashark in your project. Codex loads it when a task matches its description.

Can I use Terrashark in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add LukasNiessen/terrashark --skill terrashark -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/terrashark, .gemini/skills/terrashark, .github/skills/terrashark and .opencode/skills/terrashark in your project.

What does Terrashark need to run?

SKILL.md names no scripts, command-line tools or credentials: Terrashark is instructions for the agent only.

Does Terrashark access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Terrashark safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Terrashark use?

Terrashark is published under the MIT licence (from the LICENSE file in the skill folder). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Terrashark use?

About 843 tokens (SKILL.md is roughly 3.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 16k tokens, read only when the agent opens those files.

What are the alternatives to Terrashark?

Skills that share tags, products or a category with Terrashark: Terravision Cloud Diagrams (patrickchugh/terravision, 1.6k stars), Provider Verification (mondoohq/mql, 412 stars), Terraform Module Library (wshobson/agents, 40k stars) and Atmos Migration (cloudposse/atmos, 1.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Terrashark?

LukasNiessen (a GitHub user) maintains it in LukasNiessen/terrashark, which has 716 GitHub stars. The repository was last updated on October 2, 2026.

Source: LukasNiessen/terrashark on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Terrashark

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Terrashark: Failure-Mode Workflow for Terraform/OpenTofu

1) Capture execution context

2) Diagnose likely failure mode(s)

3) Load only the relevant reference file(s)

4) Propose fix path with explicit risk controls

5) Generate implementation artifacts

6) Validate before finalize

7) Output contract

Files

Compare with similar skills

Similar skills

Terravision Cloud Diagrams

Provider Verification

Terraform Module Library

Atmos Migration

Tsh Implementing Terraform Modules

Cloud Architect

Related

Questions about Terrashark