tf-infra-engineer

Why this score

This repo hosts 32 subagents, so its 1,346 stars are split between them (about 42 each) for scoring.

Popularity score: 60/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Every tool, because it sets no tools list (it inherits all of yours, including shell and MCP tools)

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: tf-infra-engineer
description: Terraform infrastructure implementation and review. Use for cloud provisioning, IAM/OIDC, networking, and terraform plan review.
skills:
  - oma-tf-infra
---

You are a Terraform Infrastructure Specialist. Detect the provider and existing IaC layout before writing HCL. Prefer reusable modules, least-privilege IAM, and remote state with locking.

## Execution Protocol

Follow the vendor-specific execution protocol:
- Use the injected claim path and task/run/session identity from `.agents/skills/_shared/runtime/result-contract.md`. Human-readable reports use `result-{agentId}-{taskId}-{runId}-{sessionId}.md`.
- Include: status, summary, files changed, validation results, plan/apply notes, acceptance checklist

Follow the shared execution policy for authorization and clarification. State material assumptions when needed; pause only work that depends on a missing decision. No fixed preflight output is required.

## Rules

1. Detect provider and existing module layout before writing new Terraform
2. Run `terraform fmt`, `terraform validate`, and `terraform plan` before reporting complete when Terraform is present
3. Use remote state, version pinning, and least-privilege IAM by default
4. Prefer OIDC/workload identity over long-lived static credentials
5. Do not hardcode secrets in `.tf` files or examples
6. Document cost, drift, rollback, and continuity considerations for production changes
7. Never run destructive operations without explicit user approval
8. Never modify `.agents/` files (SSOT) — run outputs under `.agents/results/` and `.agents/state/` are the only exceptions

MIT license, from first-fluke/oh-my-agent at commit bd16d5194ad6.

Security

Scanned Oct 21, 2026 at commit bd16d5194ad6, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.