Infrastructure Drift Detector

Name: Infrastructure Drift Detector
Rating: 76 (1 reviews)
Author: snyk

Trust Score 76/100

Detect infrastructure drift between Terraform state and real cloud resources; report unmanaged/changed/missing resources for remediation.

triggers:driftterraform driftinfrastructure driftsnyk iacunmanaged resourcesterraform statedrift detection

GitHub SKILL.md

What it does

This skill automates a drift-detection workflow: compare Terraform state to actual cloud resources and surface unmanaged, changed, or missing resources. It documents risk categories, suggests remediation paths (import, revert, or delete), and includes CI integration examples for scheduled auditing. The skill relies on the Snyk CLI (snyk iac describe) to perform the comparison and emit JSON for analysis.

When to use it

Run during pre-deployment checks, post-incident audits, or regular infra hygiene sweeps when you need to ensure infrastructure matches IaC. Use for shadow-IT discovery, security reviews, or to gate deployments on drift-free state.

What's included

Scripts: none bundled (has_scripts=false) — the SKILL provides command examples and CI snippets
References: repo contains references/ materials (has_references=true) that complement the workflow
Instructions: stepwise guidance for local and remote state scans, cloud credential validation, JSON output generation, risk categorization, and remediation recommendations.

Compatible agents

Agents capable of running CLI tools and interacting with cloud APIs (DevOps assistants, CI-integrated bots, or agents with Snyk/terraform knowledge).

Audit Summary

Snyk drift-detector skill provides structured instructions for detecting infrastructure drift between Terraform state and cloud resources using `snyk iac describe`. No bundled scripts — it's a pure instruction-based skill. The SKILL.md is well-organized with clear phases, but relies entirely on external tools (Snyk CLI, cloud CLIs, Terraform) and credentials being pre-configured. No security concerns beyond inherent cloud credential requirements.

Watch Out

Requires Snyk CLI installed and authenticated (paid Snyk Infrastructure as Code feature)
Needs cloud provider credentials configured (AWS/Azure/GCP)
Requires Terraform state file access (local or remote backend)
No bundled scripts — purely instructional, agent must construct commands manually
The remediation commands (terraform import, aws terminate) go beyond read-only despite the constraint stating read-only

Notes

Well-structured SKILL.md with clear phases and good error handling guidance. Security deducted for Phase 4 remediation commands that include destructive operations (aws s3 rb --force, ec2 terminate-instances) with only 'After verification' as a guard — no dry-run or confirmation step enforced. Architecture is solid but references external files (SERVICES.md, EXAMPLES.md) that aren't bundled. Usefulness is moderate — niche audience (teams using both Snyk IaC and Terraform), and requires significant external setup. The remediation section contradicts the stated read-only constraint.

Information

Repository: studio-recipes
Stars: 18
Installs: 0

Trust Score

Overall76

Security82

Code Quality72

Architecture68

Usefulness55

Related Skills

Development Worktree

Create an isolated git worktree for feature work, auto-run project setup, and verify a clean test baseline before development.

Spring Boot Migration

Guided, phased migration for existing Spring Boot apps to Boot 4 / Java 25 (including Modulith 2 and Testcontainers 2), with scanners and reference guides.

ArcKit Architecture Conformance

Run a systematic architecture conformance assessment that compares ADRs and principles against HLD/DLD artifacts to surface drift, violations, and technical deb

Speak Security Basics

Security best practices for integrating Speak: API key management, audio data privacy, student data protection, and COPPA/FERPA compliance for production deploy

Replit — Advanced Troubleshooting

Step-by-step diagnostics and debugging techniques for deep Replit issues: Nix build failures, container crash loops, memory leaks, and platform vs app isolation

Vercel Common Errors

Diagnose and fix common Vercel build, serverless runtime, and edge/routing errors with step-by-step checks and fixes.

Vitepress Config Creator

Generates and validates VitePress configuration for documentation sites, following best-practices for docs automation.

Anima Rate Limits

Patterns and code for throttling Anima API code-generation calls, batching node processing, and handling 429s with progressive backoff for design-system scale w

Back to Skills