Install the "tirith-migrate" agent skill from https://github.com/StackGuardian/tirith/tree/main/.claude/skills/tirith-migrate into .claude/skills/tirith-migrate/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tirith-migrate", then confirm the skill loads.
Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
skills CLI
$ npx skills add StackGuardian/tirith --skill tirith-migrate -a codex
Project install goes to .agents/skills/; add -g for ~/.codex/skills/.
Install the "tirith-migrate" agent skill from https://github.com/StackGuardian/tirith/tree/main/.claude/skills/tirith-migrate into .agents/skills/tirith-migrate/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tirith-migrate", then confirm the skill loads.
Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
skills CLI
$ npx skills add StackGuardian/tirith --skill tirith-migrate -a cursor
Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.
Install the "tirith-migrate" agent skill from https://github.com/StackGuardian/tirith/tree/main/.claude/skills/tirith-migrate into .cursor/skills/tirith-migrate/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tirith-migrate", then confirm the skill loads.
Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
skills CLI
$ npx skills add StackGuardian/tirith --skill tirith-migrate -a gemini-cli
Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.
Install the "tirith-migrate" agent skill from https://github.com/StackGuardian/tirith/tree/main/.claude/skills/tirith-migrate into .gemini/skills/tirith-migrate/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tirith-migrate", then confirm the skill loads.
Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
skills CLI
$ npx skills add StackGuardian/tirith --skill tirith-migrate -a github-copilot
Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.
Install the "tirith-migrate" agent skill from https://github.com/StackGuardian/tirith/tree/main/.claude/skills/tirith-migrate into .github/skills/tirith-migrate/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tirith-migrate", then confirm the skill loads.
GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
skills CLI
$ npx skills add StackGuardian/tirith --skill tirith-migrate -a opencode
OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
Install the "tirith-migrate" agent skill from https://github.com/StackGuardian/tirith/tree/main/.claude/skills/tirith-migrate into .opencode/skills/tirith-migrate/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tirith-migrate", then confirm the skill loads.
OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
Skill name
tirith-migrate
GitHub stars
167
Token cost
~1.7k tokens
SKILL.md length
818 words
Files
92
Skills in repo
3
Repo updated
First seen
Licence
Apache-2.0
At a glance
Translate existing policy-as-code into Tirith policies. An agent skill from StackGuardian/tirith.
Works in 6 steps: Inventory. List every source policy.… → Classify before translating. For each… → Translate exact and approximate. Carry… → …
Asked to migrate
SKILL.md covers Vocabulary comes from…, Per-source references, The protocol and Rules that hold for every source, plus 2 more sections
Reaches stackguardian.github.io
What it does
Tirith Migrate is an agent skill from StackGuardian/tirith. Translate existing policy-as-code into Tirith policies. HashiCorp Sentinel and Azure Policy today; Checkov, OPA/Rego and conftest are planned. Use when asked to migrate, convert, port or translate policies to Tirith, when a repository contains .sentinel files or a sentinel.hcl, when given an Azure Policy definition, initiative or assignment (a policyRule with if/then), or when asked what a Sentinel or Azure policy would look like in Tirith. Requires the tirith-policies skill for the target vocabulary.
Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 96 other files (for example `examples/azure-policy/README.md`, `examples/azure-policy/allowed-locations/notes.md` and `examples/azure-policy/allowed-locations/policy.json`).
It sits in DevOps & Cloud, covering Infrastructure as code. It works with Microsoft Azure, Terraform and Amazon Web Services. The repository describes itself as: Plug IaC governance into any IaC pipeline. Evaluate plans with Tirith, protect sensitive values, enforce centralised policies, and surface actionable results before… The licence is Apache-2.0.
When your agent uses it
Asked to migrate
Translate policies to Tirith
A repository contains .sentinel files
Given an Azure Policy definition
Example prompts
“/tirith-migrate”
Workflow steps
6 steps, taken from the first numbered list in SKILL.md.
1Inventory. List every source policy. Read the policy-set manifest (sentinel.hcl, an
2Classify before translating. For each policy, name its pattern from the source reference
3Translate exact and approximate. Carry meta.name from the source policy name, put the
4Refuse not expressible in words. Write what the policy does, what Tirith cannot see, and
5Verify every translation against the source's own tests. Sentinel policies ship mocks under
6Hand back a report, one row per source policy: name, fidelity, Tirith file, and one line
What it can do on your machine
Read from SKILL.md and the folder at commit 4a3411e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
stackguardian.github.io
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Tirith Migrate loads about 1.7k tokens when it runs. Until then it costs about 130 tokens; SKILL.md has 818 words of instructions outside code blocks.
Always· name and description, kept in context so the agent knows when to use it
~130
When it runs· the whole SKILL.md, loaded when a task matches
~1.7k
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
Download SKILL.mdSave it as .claude/skills/tirith-migrate/SKILL.md (or your agent's skills folder). This skill also uses 91 other files; get the full folder from GitHub.
name
tirith-migrate
description
Translate existing policy-as-code into Tirith policies. HashiCorp Sentinel and Azure Policy today; Checkov, OPA/Rego and conftest are planned. Use when asked to migrate, convert, port or translate policies to Tirith, when a repository contains .sentinel files or a sentinel.hcl, when given an Azure Policy definition, initiative or assignment (a policyRule with if/then), or when asked what a Sentinel or Azure policy would look like in Tirith. Requires the tirith-policies skill for the target vocabulary.
Migrate policies to Tirith
A migration is a projection from a larger language onto a smaller one. Sentinel and Rego are
programs; a Tirith policy is JSON that names a provider, a value, and a condition. Most real
policies fit. Some do not, and the failure mode is quiet: a translation that parses, looks right,
and gates nothing. This skill exists to say which is which before any JSON is written.
Vocabulary comes from tirith-policies
Do not translate from memory. Read ../tirith-policies/reference/schema.md for the closed list of
providers, operations, argument keys and the thirteen condition types. If that skill is not
installed, fetch https://stackguardian.github.io/tirith/llms.txt and follow it to the schema
page. Everything below assumes that vocabulary.
Per-source references
Source
Reference
Status
HashiCorp Sentinel
reference/sentinel.md, corpus in reference/sentinel-corpus.md
Measured against 110 public policies
Azure Policy
reference/azure-policy.md, corpus in reference/azure-policy-corpus.md
713 built-ins classified; Terraform and ARM targets
Checkov
Planned
OPA / Rego, conftest
Planned
The protocol
Inventory. List every source policy. Read the policy-set manifest (sentinel.hcl, an
Azure initiative or assignment) for enforcement levels and parameter values. Note which
policies are registered twice with different parameters; they translate once. For Azure,
decide the target first: Terraform plan or ARM template.
Classify before translating. For each policy, name its pattern from the source reference
and assign a fidelity:
exact: a Tirith policy returns the same verdict on every plan.
approximate: expressible, but stricter or looser in a case you can name.
not expressible: needs something Tirith lacks. Name it, and link the tracking issue.
Translate exact and approximate. Carry meta.name from the source policy name, put the
Sentinel enforcement level in meta.enforcement, and map every param to {{ var.NAME }}.
If an approximation drops the test a param fed, do not ship an unread variables.json: name
the orphaned parameter in the notes and in the report row.
Refuse not expressible in words. Write what the policy does, what Tirith cannot see, and
the issue that would change that. Do not write a policy that checks something adjacent.
Verify every translation against the source's own tests. Sentinel policies ship mocks under
test/<policy>/. Transcribe the failing mock into should-fail.json and the passing one into
should-pass.json (the mocks already have the resource_changes shape). Run both:bash
For an approximate translation, also write diverges.json: a plan where the source and the
translation disagree. The reviewer needs to see the divergence, not read about it.
Hand back a report, one row per source policy: name, fidelity, Tirith file, and one line
on what changed. Fidelity is the column the reader looks at first.
Show full SKILL.md (391 more words)Show less
Rules that hold for every source
A Tirith evaluator yields one result per matching resource and fails if any fails. That is the
universal quantifier. There is no existential: "at least one resource satisfies X" does not map.
eval_expression combines evaluator verdicts, each already collapsed across all resources. It
cannot bind two tests to the same resource or the same nested block. "Where type is ingress,
cidr must not be open" becomes "no block may have cidr open", which is stricter. Say so.
attribute reads change.after only. Anything about the previous value, a destroyed resource,
or a value unknown until apply is invisible.
Configuration is not the plan. Module sources, variables, outputs, provisioners and expression
references live in tfconfig; Tirith reads none of them.
A resource skipped through error_tolerance does not touch the verdict of the others: an
evaluator fails if any resource fails, passes if none fail and at least one was evaluated, and
is skipped only when every resource was tolerated away. Test with mixed plans anyway; that is
where a scope difference shows.
Before you hand it back
Did every policy get a fidelity before it got JSON?
Does every approximate row name the case where verdicts differ, and ship diverges.json?
Does every not expressible row link a Tirith issue or say "not tracked"?
Did every translated policy exit 3 on should-fail.json and 0 on should-pass.json?
Is every param a {{ var.NAME }} with a variables.json beside the policy, or named as
orphaned in the report?
Is every condition type and argument key taken from schema.md, not recalled?
Worked examples
examples/azure-policy/ holds eight Azure built-ins, the ones a customer assigns first, each with
the verbatim definition, the Tirith policy for a Terraform plan (one also for an ARM template), and
the plans that prove it. examples/azure-policy/README.md is the index.
examples/sentinel/ holds five translations from the idioms of HashiCorp's public policy
libraries, each with its Sentinel source, the Tirith policy, and the plans that prove it:
Example
Fidelity
Shows
restrict-instance-type
exact
filter_attribute_not_in_list to ContainedIn; param to -var
mandatory-tags
exact
Tag keys via Contains on the map; one evaluator per key and type
prevent-database-destroy
exact
action emits one result per action; NotEquals "delete" catches deletes and replacements
restrict-ssh-ingress
approximate
The per-block conjunction collapses to a stricter rule
Tirith Migrate next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
Build reusable, tested Terraform modules for AWS, Azure, GCP and OCI, with a standard file layout, an AWS VPC example, versioning rules and Terratest checks.
Migrate to Atmos from native Terraform, Terraform Workspaces, Terramate, Terragrunt, Make, Just, or Task; migrate tool versions from mise or Aqua CLI; migrate AWS/GCP/Azure CLI configs, Leapp…
Write, validate, run and debug Tirith IaC governance policies, install Tirith, and add it to a CI pipeline (GitHub Actions, GitLab CI, Bitbucket Pipelines, Jenkins, Azure DevOps, CircleCI or any…
Generate a Tirith policy set for an existing Terraform or OpenTofu repository, covering organization standards such as required tags, naming conventions, allowed regions, permitted resource types…
Translate existing policy-as-code into Tirith policies. An agent skill from StackGuardian/tirith. Tirith Migrate is an agent skill from StackGuardian/tirith. Translate existing policy-as-code into Tirith policies.
When should I use Tirith Migrate?
Tirith Migrate fits situations like: asked to migrate; translate policies to Tirith; A repository contains .sentinel files; given an Azure Policy definition.
How do I install Tirith Migrate in Claude Code?
Run `npx skills add StackGuardian/tirith --skill tirith-migrate -a claude-code`. Or copy the skill folder (.claude/skills/tirith-migrate in StackGuardian/tirith) into .claude/skills/tirith-migrate in your project. Claude Code loads it when a task matches its description.
How do I install Tirith Migrate in Codex?
Run `npx skills add StackGuardian/tirith --skill tirith-migrate -a codex`. Or copy the skill folder (.claude/skills/tirith-migrate in StackGuardian/tirith) into .agents/skills/tirith-migrate in your project. Codex loads it when a task matches its description.
Can I use Tirith Migrate in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add StackGuardian/tirith --skill tirith-migrate -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/tirith-migrate, .gemini/skills/tirith-migrate, .github/skills/tirith-migrate and .opencode/skills/tirith-migrate in your project.
What does Tirith Migrate need to run?
SKILL.md names no scripts, command-line tools or credentials: Tirith Migrate is instructions for the agent only.
Does Tirith Migrate access the network?
SKILL.md names 1 domain. In commands or code: stackguardian.github.io; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.
Is Tirith Migrate safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Tirith Migrate use?
Tirith Migrate is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Tirith Migrate use?
About 1.7k tokens (SKILL.md is roughly 6.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Tirith Migrate?
Skills that share tags, products or a category with Tirith Migrate: Terravision Cloud Diagrams (patrickchugh/terravision, 1.6k stars), Terrashark (LukasNiessen/terrashark, 715 stars), Provider Verification (mondoohq/mql, 411 stars) and Terraform Module Library (wshobson/agents, 40k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Tirith Migrate?
StackGuardian (a GitHub organization) maintains it in StackGuardian/tirith, which has 167 GitHub stars. The repository holds 3 skills in this directory. The repository was last updated on October 6, 2026.
Source: StackGuardian/tirith on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
