See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
PromptWhen reviewing the output of a terraform plan during a drift check, into what categories should the detected changes be classified?
What was checked, without and with the skill| Checked | Without skill | With skill |
|---|
| Recommends classifying changes into safe or no-op changes, risky replacements, and access-related modifications | Missed | Passed |
|---|
What's inside
The instructions your model reads when the skill loads.
SKILL.md43 linessingle file
When to use
Use when a plan shows unexpected changes or monitoring indicates config drift.
Preconditions
- You can run
terraform plan against the workspace/backend.
- You can inspect change history (VCS and/or cloud audit logs).
Procedure
- Run a plan and classify changes: safe/no-op, risky replacement, access-related.
- Identify when drift started (compare to deploys and change logs).
- Determine the mutator: manual console change, controller, autoscaling, policy.
- Decide the source of truth: Terraform config vs external system.
- Choose reconciliation: update config, import, ignore changes, or revert manual change.
Decision points
- Replacement of critical resources: stop and coordinate; avoid apply during incidents.
- Autoscaled fields: consider lifecycle ignore for managed attributes.
- Manual hotfix required: capture it in code and remove out-of-band changes.
Verification
- A new plan is stable (no unexpected diffs).
- Audit logs align with expected change process.
Rollback / undo
- Revert config commits that introduced unintended drift.
- Restore from snapshots/backups if drift caused breakage.
Escalation
- IaC owners for state manipulation or imports.
- Security team if drift indicates unauthorized access.
Examples
Track record
Benchmark
20 / 22
test cases passed, vs 19 / 22 without
Adoption
- Users
- 6
- Times used
- 135
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v4 — 8/1/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
Importedbregman-arie / devops-sre-skills
skills/terraform/investigate-drift/SKILL.md
License Apache-2.0Imported 8/1/2026Version v1