Add HashiCorp Terraform and Packer skills

[danbarr]

Summary

• Packages all 20 skills from hashicorp/agent-skills (16 Terraform, 4 Packer) at commit 4451ceca5456e79cc776efee96a744f7ac96e5bf (main as of 2026-08-10) as Dockyard skill artifacts under skills/hashicorp-*.
• Names are prefixed hashicorp- (flat, not split by plugin) to avoid collisions with generic upstream names like provider-docs, provider-actions, and windows-builder in the shared skill catalog, and to avoid stutter on names that already contain "terraform" (terraform-test, terraform-stacks, etc).
• Each spec.yaml starts at spec.version: 0.1.0, per Dockyard's own-your-semver policy (docs/skill-versioning.md) — upstream's v1.0.0 tag is a whole-repo release, not a per-skill version, and several skills' own SKILL.md frontmatter versions are 0.0.x/0.1.x anyway.
• security.allowed_issues entries allowlist the false positives surfaced by skill-scanner (HCL interpolation syntax, documented install commands like the Chocolatey/apt bootstrap, example IPs/credentials in Terraform/Packer docs, missing per-skill license field where upstream doesn't set one), each with cited file:line evidence.

Test plan

• dockhand validate-skill passes for all 20 spec.yaml files
• task scan-skill passes cleanly (no unallowlisted findings) for all 20
• dockhand build-skill built successfully for a sample skill (hashicorp-terraform-test)

Signed-off-by: Dan Barr 6922515+danbarr@users.noreply.github.com

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ hashicorp-aws-ami-builder

• Status: Passed
• Findings: 4
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-azure-image-builder

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-azure-verified-modules

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-new-terraform-provider

• Status: Passed
• Findings: 3

✅ hashicorp-provider-actions

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-provider-configuration

• Status: Passed
• Findings: 0

✅ hashicorp-provider-docs

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-provider-ephemeral-resources

• Status: Passed
• Findings: 0

✅ hashicorp-provider-framework-migration

• Status: Passed
• Findings: 0

✅ hashicorp-provider-resources

• Status: Passed
• Findings: 0

✅ hashicorp-provider-test-patterns

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-push-to-registry

• Status: Passed
• Findings: 4
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-refactor-module

• Status: Passed
• Findings: 4
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-run-acceptance-tests

• Status: Passed
• Findings: 2

✅ hashicorp-terraform-policy

• Status: Passed
• Findings: 3

✅ hashicorp-terraform-search-import

• Status: Passed
• Findings: 8
• Allowed (not blocking): 3
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • ATR_2026_00066 (Allowed: FP: matched Terraform HCL string-interpolation syntax (${...}) or GitHub Actions secrets.* references in documented configuration/CI examples (e.g. references/MANUAL-IMPORT.md:99, references/MANUAL-IMPORT.md:104) — standard HCL/CI syntax, not injected secrets.)
  • ATR_2026_00066 (Allowed: FP: matched Terraform HCL string-interpolation syntax (${...}) or GitHub Actions secrets.* references in documented configuration/CI examples (e.g. references/MANUAL-IMPORT.md:99, references/MANUAL-IMPORT.md:104) — standard HCL/CI syntax, not injected secrets.)

✅ hashicorp-terraform-stacks

• Status: Passed
• Findings: 76
• Allowed (not blocking): 29
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • ATR_2026_00051 (Allowed: FP: matched "every item"/"all files"/"all table" describing bulk Terraform operations such as import or code generation in documentation (e.g. SKILL.md:23, references/linked-stacks.md:187), not a bulk-exfiltration action.)
  • ATR_2026_00113 (Allowed: FP: matched documented credential-chain/identity-token setup instructions (AWS/Azure/GCP dynamic credentials, ~/.aws/credentials path) (e.g. SKILL.md:146, references/deployment-blocks.md:59) — standard provider authentication guidance.)
  • ATR_2026_00066 (Allowed: FP: matched Terraform HCL string-interpolation syntax (${...}) or GitHub Actions secrets.* references in documented configuration/CI examples (e.g. SKILL.md:211, SKILL.md:308) — standard HCL/CI syntax, not injected secrets.)
  • PG_PII_CREDENTIAL_HARVESTING (Allowed: FP: matched documentation describing the user's own cloud credential storage in Terraform Cloud varsets or CI secrets (e.g. SKILL.md:255, references/api-monitoring.md:29) — configuration guidance, not credential harvesting.)
  • ATR_2026_00063 (Allowed: FP: matched words like "exfil"/"upload"/"encrypt" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. SKILL.md:296, SKILL.md:371), not exfiltration code.)
  • ATR_2026_00066 (Allowed: FP: matched Terraform HCL string-interpolation syntax (${...}) or GitHub Actions secrets.* references in documented configuration/CI examples (e.g. SKILL.md:211, SKILL.md:308) — standard HCL/CI syntax, not injected secrets.)
  • ATR_2026_00063 (Allowed: FP: matched words like "exfil"/"upload"/"encrypt" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. SKILL.md:296, SKILL.md:371), not exfiltration code.)
  • ATR_2026_00063 (Allowed: FP: matched words like "exfil"/"upload"/"encrypt" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. SKILL.md:296, SKILL.md:371), not exfiltration code.)
  • ATR_2026_00063 (Allowed: FP: matched words like "exfil"/"upload"/"encrypt" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. SKILL.md:296, SKILL.md:371), not exfiltration code.)
  • ATR_2026_00063 (Allowed: FP: matched words like "exfil"/"upload"/"encrypt" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. SKILL.md:296, SKILL.md:371), not exfiltration code.)
  • ATR_2026_00063 (Allowed: FP: matched words like "exfil"/"upload"/"encrypt" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. SKILL.md:296, SKILL.md:371), not exfiltration code.)
  • ATR_2026_00111 (Allowed: FP: matched curl -L used to download the official HashiCorp/vendor CLI release binary (e.g. SKILL.md:425, references/api-monitoring.md:332) — a documented, vendor-published install step.)
  • ATR_2026_00063 (Allowed: FP: matched words like "exfil"/"upload"/"encrypt" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. SKILL.md:296, SKILL.md:371), not exfiltration code.)
  • PG_PII_CREDENTIAL_HARVESTING (Allowed: FP: matched documentation describing the user's own cloud credential storage in Terraform Cloud varsets or CI secrets (e.g. SKILL.md:255, references/api-monitoring.md:29) — configuration guidance, not credential harvesting.)
  • ATR_2026_00090 (Allowed: FP: matched "Extract API Token from Credential..." heading describing how a user's own monitoring pipeline reads its own token (e.g. references/api-monitoring.md:29), documentation prose.)
  • ATR_2026_00012 (Allowed: FP: matched code-example tokens (e.g. references/api-monitoring.md:39, references/api-monitoring.md:47) in Go/HCL/API code snippets or shell examples — legitimate example code, not a hidden execution primitive.)
  • ATR_2026_00012 (Allowed: FP: matched code-example tokens (e.g. references/api-monitoring.md:39, references/api-monitoring.md:47) in Go/HCL/API code snippets or shell examples — legitimate example code, not a hidden execution primitive.)
  • ATR_2026_00063 (Allowed: FP: matched words like "exfil"/"upload"/"encrypt" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. SKILL.md:296, SKILL.md:371), not exfiltration code.)
  • ATR_2026_00063 (Allowed: FP: matched words like "exfil"/"upload"/"encrypt" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. SKILL.md:296, SKILL.md:371), not exfiltration code.)
  • ATR_2026_00012 (Allowed: FP: matched code-example tokens (e.g. references/api-monitoring.md:39, references/api-monitoring.md:47) in Go/HCL/API code snippets or shell examples — legitimate example code, not a hidden execution primitive.)
  • ATR_2026_00012 (Allowed: FP: matched code-example tokens (e.g. references/api-monitoring.md:39, references/api-monitoring.md:47) in Go/HCL/API code snippets or shell examples — legitimate example code, not a hidden execution primitive.)
  • ATR_2026_00066 (Allowed: FP: matched Terraform HCL string-interpolation syntax (${...}) or GitHub Actions secrets.* references in documented configuration/CI examples (e.g. SKILL.md:211, SKILL.md:308) — standard HCL/CI syntax, not injected secrets.)
  • ATR_2026_00012 (Allowed: FP: matched code-example tokens (e.g. references/api-monitoring.md:39, references/api-monitoring.md:47) in Go/HCL/API code snippets or shell examples — legitimate example code, not a hidden execution primitive.)
  • ATR_2026_00066 (Allowed: FP: matched Terraform HCL string-interpolation syntax (${...}) or GitHub Actions secrets.* references in documented configuration/CI examples (e.g. SKILL.md:211, SKILL.md:308) — standard HCL/CI syntax, not injected secrets.)
  • ATR_2026_00012 (Allowed: FP: matched code-example tokens (e.g. references/api-monitoring.md:39, references/api-monitoring.md:47) in Go/HCL/API code snippets or shell examples — legitimate example code, not a hidden execution primitive.)
  • ATR_2026_00066 (Allowed: FP: matched Terraform HCL string-interpolation syntax (${...}) or GitHub Actions secrets.* references in documented configuration/CI examples (e.g. SKILL.md:211, SKILL.md:308) — standard HCL/CI syntax, not injected secrets.)
  • ATR_2026_00012 (Allowed: FP: matched code-example tokens (e.g. references/api-monitoring.md:39, references/api-monitoring.md:47) in Go/HCL/API code snippets or shell examples — legitimate example code, not a hidden execution primitive.)
  • ATR_2026_00012 (Allowed: FP: matched code-example tokens (e.g. references/api-monitoring.md:39, references/api-monitoring.md:47) in Go/HCL/API code snippets or shell examples — legitimate example code, not a hidden execution primitive.)

✅ hashicorp-terraform-style-guide

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-terraform-test

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ hashicorp-windows-builder

• Status: Passed
• Findings: 6
• Allowed (not blocking): 2
  • MANIFEST_MISSING_LICENSE (Allowed: hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • ATR_2026_00010 (Allowed: FP: matched the documented Chocolatey bootstrap command iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')) (SKILL.md:101) — the official Chocolatey install script run inside a Packer PowerShell provisioner to build a Windows image, not a hidden payload.)

---

Summary: Scanned 20 skill(s), all passed security checks. ✅