terraform-ingest-configure — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited terraform-ingest-configure (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Guide the user through config.yaml using CLI commands. Ask one question at a time.
Task Progress:
- [ ] Step 1: Confirm config file path
- [ ] Step 2: Set output and clone directories
- [ ] Step 3: Add repositories
- [ ] Step 4: Configure embeddings (optional)
- [ ] Step 5: Configure MCP behavior (optional)
- [ ] Step 6: Validate configuration
- [ ] Step 7: Hand off to terraform-ingest-ingestDefault: config.yaml in the project root. Override with --config / -c on all commands.
terraform-ingest config get --target output_dirterraform-ingest config set --target output_dir --value ./output
terraform-ingest config set --target clone_dir --value ./reposUse absolute paths in production or container deployments.
Ask the user for each repo:
main) — empty list ingests default branchmax_tags)path, default .)--recursive for monorepos)Single repo:
terraform-ingest config add-repo \
--url https://github.com/terraform-aws-modules/terraform-aws-vpc \
--name aws-vpc \
--branches main \
--max-tags 3Monorepo with submodules:
terraform-ingest config add-repo \
--url [email protected]/myorg/terraform-modules.git \
--name my-modules \
--branches main \
--recursive \
--path modulesBulk import from GitHub org (many repos):
export GITHUB_TOKEN=ghp_xxx # if needed
terraform-ingest import github --org myorg --terraform-onlyVerify:
terraform-ingest config get --target repositoriesEnable for search_modules_vector in MCP:
terraform-ingest config set --target embedding.enabled --value true
terraform-ingest config set --target embedding.strategy --value chromadb-default
terraform-ingest install-deps --strategy chromadb-defaultStrategies: chromadb-default (local, no API key), sentence-transformers, openai, claude.
Avoid chromadb_path: ./chromadb at the project root — it shadows the chromadb Python package. Prefer ./data/chromadb or an absolute path outside the repo.
For OpenAI:
terraform-ingest config set --target embedding.strategy --value openai
# Set OPENAI_API_KEY in environmentTune for agents that will connect via MCP later:
terraform-ingest config set --target mcp.ingest_on_startup --value true
terraform-ingest config set --target mcp.auto_ingest --value true
terraform-ingest config set --target mcp.refresh_interval_hours --value 24Customize agent behavior via mcp.instructions in config — see MCP docs. Do not paste full instructions into chat; edit the YAML field or use config set for nested paths.
Run before ingestion:
terraform-ingest skills validate-config config.yamlFix any reported errors. An empty repositories list warns but does not fail — confirm with the user before ingesting.
Invoke terraform-ingest-ingest to run the first ingestion.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.