Add HashiCorp Terraform and Packer skills

skills/hashicorp-aws-ami-builder/spec.yaml

@@ -0,0 +1,33 @@
+# HashiCorp hashicorp-aws-ami-builder Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-aws-ami-builder:0.1.0
+
+metadata:
+  name: hashicorp-aws-ami-builder
+  description: Build Amazon Machine Images (AMIs) with Packer using the amazon-ebs builder. Use when creating
+    custom AMIs for EC2 instances.
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/packer/skills/aws-ami-builder"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
+    - rule_id: ATR_2026_00010
+      reason: "FP: matched the documented package-manager install command (e.g. SKILL.md:58, SKILL.md:59) for the CLI/tooling covered by this skill — the vendor-recommended install step, not a hidden payload."
+    - rule_id: ATR_2026_00062
+      reason: "FP: matched placeholder tokens like `_SECRET_`/`__generated__`/`_secret_` used as example variable or env-var names in documentation (e.g. SKILL.md:120, SKILL.md:126), not real secrets."
+    - rule_id: ATR_2026_00065
+      reason: "FP: matched \"data transfer\" describing cloud egress cost considerations in documentation prose (e.g. SKILL.md:7)."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched Terraform HCL string-interpolation syntax (`${...}`) or GitHub Actions `secrets.*` references in documented configuration/CI examples (e.g. SKILL.md:45, SKILL.md:109) — standard HCL/CI syntax, not injected secrets."
+    - rule_id: ATR_2026_00113
+      reason: "FP: matched documented credential-chain/identity-token setup instructions (AWS/Azure/GCP dynamic credentials, `~/.aws/credentials` path) (e.g. SKILL.md:121) — standard provider authentication guidance."

skills/hashicorp-azure-image-builder/spec.yaml

@@ -0,0 +1,31 @@
+# HashiCorp hashicorp-azure-image-builder Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-azure-image-builder:0.1.0
+
+metadata:
+  name: hashicorp-azure-image-builder
+  description: Build Azure managed images and Azure Compute Gallery images with Packer. Use when creating
+    custom images for Azure VMs.
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/packer/skills/azure-image-builder"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
+    - rule_id: ATR_2026_00010
+      reason: "FP: matched the documented package-manager install command (e.g. SKILL.md:76, SKILL.md:77) for the CLI/tooling covered by this skill — the vendor-recommended install step, not a hidden payload."
+    - rule_id: ATR_2026_00065
+      reason: "FP: matched \"data transfer\" describing cloud egress cost considerations in documentation prose (e.g. SKILL.md:7)."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched Terraform HCL string-interpolation syntax (`${...}`) or GitHub Actions `secrets.*` references in documented configuration/CI examples (e.g. SKILL.md:55, SKILL.md:104) — standard HCL/CI syntax, not injected secrets."
+    - rule_id: ATR_2026_00114
+      reason: "FP: matched placeholder credential values like `CLIENT_SECRET=\"your-client-secret\"` in documented example commands (e.g. SKILL.md:142) — literal placeholders, not real secrets."

skills/hashicorp-azure-verified-modules/spec.yaml

@@ -0,0 +1,29 @@
+# HashiCorp hashicorp-azure-verified-modules Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-azure-verified-modules:0.1.0
+
+metadata:
+  name: hashicorp-azure-verified-modules
+  description: Azure Verified Modules (AVM) requirements and best practices for developing certified Azure
+    Terraform modules. Use when creating or reviewing Azure modules that need AVM certification.
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/terraform/skills/azure-verified-modules"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
+    - rule_id: ATR_2026_00013
+      reason: "FP: matched example IP addresses or `internal/` package paths in Terraform configuration/code examples (e.g. SKILL.md:114) — standard placeholder addressing or Go module layout, not exfiltration to an internal network."
+    - rule_id: ATR_2026_00060
+      reason: "FP: matched \"Azure-Verified\"/\"azure-verified\", the official Azure Verified Modules (AVM) program name, in documentation (e.g. SKILL.md:6, SKILL.md:7)."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched Terraform HCL string-interpolation syntax (`${...}`) or GitHub Actions `secrets.*` references in documented configuration/CI examples (e.g. SKILL.md:111, SKILL.md:223) — standard HCL/CI syntax, not injected secrets."

skills/hashicorp-new-terraform-provider/spec.yaml

@@ -0,0 +1,20 @@
+# HashiCorp hashicorp-new-terraform-provider Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-new-terraform-provider:0.1.0
+
+metadata:
+  name: hashicorp-new-terraform-provider
+  description: 'Use this when scaffolding a new Terraform provider with the Plugin Framework: workspace
+    layout, go module setup, provider server main.go, and a provider.go with schema and Configure. Also
+    use when a user wants to start building a provider for a new API or asks how to begin a terraform-provider-*
+    project.'
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/terraform/skills/new-terraform-provider"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"

skills/hashicorp-provider-actions/spec.yaml

@@ -0,0 +1,29 @@
+# HashiCorp hashicorp-provider-actions Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-provider-actions:0.1.0
+
+metadata:
+  name: hashicorp-provider-actions
+  description: Implement Terraform Provider actions using the Plugin Framework. Use when developing imperative
+    operations that execute at lifecycle events (before/after create, update, destroy).
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/terraform/skills/provider-actions"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
+    - rule_id: ATR_2026_00001
+      reason: "FP: matched imperative-sounding doc prose (e.g. SKILL.md:424) describing Terraform/Packer usage guidance, not an injected directive to the agent."
+    - rule_id: ATR_2026_00013
+      reason: "FP: matched example IP addresses or `internal/` package paths in Terraform configuration/code examples (e.g. SKILL.md:25) — standard placeholder addressing or Go module layout, not exfiltration to an internal network."
+    - rule_id: ATR_2026_00032
+      reason: "FP: matched comparative \"instead of ...\" phrasing in documentation prose (e.g. SKILL.md:78), not an override instruction."

skills/hashicorp-provider-configuration/spec.yaml

@@ -0,0 +1,45 @@
+# HashiCorp hashicorp-provider-configuration Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-provider-configuration:0.1.0
+
+metadata:
+  name: hashicorp-provider-configuration
+  description: 'Implement Terraform provider configuration and authentication with the Plugin Framework:
+    provider schema for credentials (Optional + Sensitive attributes), environment variable fallbacks, credential
+    provider chains (static config, then environment variables, shared credentials file, and platform identity),
+    unknown-value guards in Configure(), secret redaction, configure-time credential validation, and diagnostics
+    that name every source tried. Use when implementing or reviewing a provider''s Configure method or provider
+    schema, adding authentication options (API keys, tokens, profiles, credentials files, assume-role),
+    deciding how a provider should resolve credentials, debugging "no valid credential sources" or missing-credentials
+    errors, or unit testing credential resolution.'
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/terraform/skills/provider-configuration"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: ATR_2026_00012
+      reason: "FP: matched code-example tokens (e.g. references/case-studies.md:31, references/credential-chain.md:233) in Go/HCL/API code snippets or shell examples — legitimate example code, not a hidden execution primitive."
+    - rule_id: ATR_2026_00013
+      reason: "FP: matched example IP addresses or `internal/` package paths in Terraform configuration/code examples (e.g. references/credential-chain.md:22) — standard placeholder addressing or Go module layout, not exfiltration to an internal network."
+    - rule_id: ATR_2026_00020
+      reason: "FP: matched \"secret settings\" describing where credentials are configured in provider documentation (e.g. SKILL.md:267, references/credential-chain.md:276), not an attempt to expose secrets."
+    - rule_id: ATR_2026_00032
+      reason: "FP: matched comparative \"instead of ...\" phrasing in documentation prose (e.g. references/credential-chain.md:109), not an override instruction."
+    - rule_id: ATR_2026_00085
+      reason: "FP: matched \"skip the identity check\"/\"skip it\" describing a documented configuration opt-out (e.g. SKILL.md:49, SKILL.md:224), not an instruction to silently bypass security."
+    - rule_id: ATR_2026_00091
+      reason: "FP: matched \"constructor\"/\"Constructor\" in Go code documentation describing struct initialization (e.g. SKILL.md:124, SKILL.md:165), not an obfuscation pattern."
+    - rule_id: ATR_2026_00113
+      reason: "FP: matched documented credential-chain/identity-token setup instructions (AWS/Azure/GCP dynamic credentials, `~/.aws/credentials` path) (e.g. references/credential-chain.md:112) — standard provider authentication guidance."
+    - rule_id: ATR_2026_00115
+      reason: "FP: matched shell `env` command usage in documented debugging examples (e.g. SKILL.md:86, SKILL.md:248), not credential dumping for exfiltration."
+    - rule_id: ATR_2026_00140
+      reason: "FP: matched the word \"reverse\"/\"opposite\" in comparative documentation prose (e.g. references/case-studies.md:3)."

skills/hashicorp-provider-docs/spec.yaml

@@ -0,0 +1,28 @@
+# HashiCorp hashicorp-provider-docs Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-provider-docs:0.1.0
+
+metadata:
+  name: hashicorp-provider-docs
+  description: Create, update, and review Terraform provider documentation for Terraform Registry using
+    HashiCorp-recommended patterns, tfplugindocs templates, and schema descriptions. Use when adding or
+    changing provider configuration, resources, data sources, ephemeral resources, list resources, functions,
+    actions, or guides; when validating generated docs; and when troubleshooting missing or incorrect Registry
+    documentation.
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/terraform/skills/provider-docs"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: MANIFEST_MISSING_LICENSE
+      reason: "hashicorp/agent-skills is licensed MPL-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched Terraform HCL string-interpolation syntax (`${...}`) or GitHub Actions `secrets.*` references in documented configuration/CI examples (e.g. references/hashicorp-provider-docs.md:45) — standard HCL/CI syntax, not injected secrets."

skills/hashicorp-provider-ephemeral-resources/spec.yaml

@@ -0,0 +1,27 @@
+# HashiCorp hashicorp-provider-ephemeral-resources Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-provider-ephemeral-resources:0.1.0
+
+metadata:
+  name: hashicorp-provider-ephemeral-resources
+  description: 'Implement Terraform provider ephemeral resources with the Plugin Framework: the Open/Renew/Close
+    lifecycle, ephemeral schema design, registration via EphemeralResources, renewal for expiring credentials,
+    and how ephemeral values flow into write-only attributes and provider configuration. Use when adding
+    an ephemeral resource, exposing secrets/tokens/certificates that must never persist in state or plan,
+    deciding between an ephemeral resource and a data source, or wiring short-lived credentials from one
+    provider into another.'
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/terraform/skills/provider-ephemeral-resources"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched Terraform HCL string-interpolation syntax (`${...}`) or GitHub Actions `secrets.*` references in documented configuration/CI examples (e.g. SKILL.md:171) — standard HCL/CI syntax, not injected secrets."

skills/hashicorp-provider-framework-migration/spec.yaml

@@ -0,0 +1,33 @@
+# HashiCorp hashicorp-provider-framework-migration Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-provider-framework-migration:0.1.0
+
+metadata:
+  name: hashicorp-provider-framework-migration
+  description: 'Migrate Terraform provider resources and data sources from Plugin SDKv2 to the Plugin Framework:
+    muxing both plugins in one provider (terraform-plugin-mux, tf5to6server), per-resource migration workflow,
+    SDKv2-to-Framework schema mapping (ForceNew, ValidateFunc, DiffSuppressFunc, Default, Timeouts, blocks),
+    null-vs-zero-value behavioral traps, and state-compatibility verification. Use when converting or translating
+    SDKv2 resources to the Framework, setting up a muxed provider server, deciding whether a resource should
+    be migrated at all, or debugging plan diffs and state errors that appeared after a migration.'
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/terraform/skills/provider-framework-migration"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: ATR_2026_00001
+      reason: "FP: matched imperative-sounding doc prose (e.g. SKILL.md:131) describing Terraform/Packer usage guidance, not an injected directive to the agent."
+    - rule_id: ATR_2026_00051
+      reason: "FP: matched \"every item\"/\"all files\"/\"all table\" describing bulk Terraform operations such as import or code generation in documentation (e.g. references/schema-mapping.md:3), not a bulk-exfiltration action."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched Terraform HCL string-interpolation syntax (`${...}`) or GitHub Actions `secrets.*` references in documented configuration/CI examples (e.g. SKILL.md:140, SKILL.md:141) — standard HCL/CI syntax, not injected secrets."
+    - rule_id: ATR_2026_00091
+      reason: "FP: matched \"constructor\"/\"Constructor\" in Go code documentation describing struct initialization (e.g. references/schema-mapping.md:46), not an obfuscation pattern."

skills/hashicorp-provider-resources/spec.yaml

@@ -0,0 +1,35 @@
+# HashiCorp hashicorp-provider-resources Skill
+# Source: https://github.com/hashicorp/agent-skills
+# Will publish as: ghcr.io/stacklok/dockyard/skills/hashicorp-provider-resources:0.1.0
+
+metadata:
+  name: hashicorp-provider-resources
+  description: 'Implement Terraform Provider resources and data sources using the Plugin Framework: CRUD
+    operations, schema design, plan modifiers and validators, not-found handling, waiters for eventually
+    consistent APIs, import support, resource design principles, and required acceptance test coverage.
+    Use when adding or changing a resource or data source, deciding whether an API concept should be a resource,
+    wiring a resource to the provider''s configured client, handling drift or resource-not-found, or reviewing
+    a resource implementation before submission.'
+
+spec:
+  repository: "https://github.com/hashicorp/agent-skills"
+  ref: "4451ceca5456e79cc776efee96a744f7ac96e5bf"  # main as of 2026-08-10
+  path: "plugins/terraform/skills/provider-resources"
+  version: "0.1.0"
+
+provenance:
+  repository_uri: "https://github.com/hashicorp/agent-skills"
+  repository_ref: "refs/heads/main"
+
+security:
+  allowed_issues:
+    - rule_id: ATR_2026_00001
+      reason: "FP: matched imperative-sounding doc prose (e.g. SKILL.md:24, references/retries-and-waiters.md:5) describing Terraform/Packer usage guidance, not an injected directive to the agent."
+    - rule_id: ATR_2026_00013
+      reason: "FP: matched example IP addresses or `internal/` package paths in Terraform configuration/code examples (e.g. SKILL.md:34) — standard placeholder addressing or Go module layout, not exfiltration to an internal network."
+    - rule_id: ATR_2026_00021
+      reason: "FP: matched the literal attribute name `password` in a Terraform schema or example (e.g. SKILL.md:330) — naming a sensitive field in example code, not a leaked credential."
+    - rule_id: ATR_2026_00063
+      reason: "FP: matched words like \"exfil\"/\"upload\"/\"encrypt\" in documentation prose — either warning against exfiltration (design-principles guidance) or describing legitimate upload/encryption features (HCP Packer registry push, state upload, disk encryption) (e.g. references/design-principles.md:18), not exfiltration code."
+    - rule_id: ATR_2026_00066
+      reason: "FP: matched Terraform HCL string-interpolation syntax (`${...}`) or GitHub Actions `secrets.*` references in documented configuration/CI examples (e.g. SKILL.md:126, SKILL.md:128) — standard HCL/CI syntax, not injected secrets."