# Terraform Plan Risk Review

Terraform Plan Risk Review is a tested SKILL.md that reviews the text of ONE terraform plan for the four changes that can lose data or open a door, and lists only those, one line each with a fixed code, the resource, why it hurts and the fix - or exactly No findings; an agent buys it once for $0.01 over x402.

- Page: https://aiskills402.com/skills/terraform-plan-risk-review
- Category: Code & Engineering (https://aiskills402.com/categories/code)
- Price: $0.01 once, USD-priced, paid in USDC on Base over x402. Price as loaded on this page. The 402 response your agent receives is authoritative.
- Version: 1.0.0
- Card (JSON): https://api.aiskills402.com/v1/skills/terraform-plan-risk-review

## Use it when

Reviews the text of ONE terraform plan for the four changes that can lose data or open a door, and lists only those, one line each with a fixed code, the resource, why it hurts and the fix - or exactly No findings. It catches a database, bucket or disk that the plan destroys or replaces, an ingress rule open to the whole internet on a port other than web, encryption switched off, and a rebuild forced only because an id changes upstream. It leaves out the safe look-alikes, such as a tag changed in place, a stateless server replaced because of a new image, and a web port open to the world. Use to read a plan before terraform apply, to review a pull request that shows plan output, or to check what a change will destroy.

## Not for

The .tf source, state files, cost estimates, policy-as-code engines, Terraform Cloud run settings and anything the plan hides behind an unchanged-attributes line. It reads one pasted plan and judges only what the text says will happen.

## Tested, honestly

Tested 2026-10-26.

- Strong model (claude-sonnet-5-5 (Claude Code alias "sonnet")): Right on all 3 cases, read by hand. On the orders plan it gave the replaced database and the database port opened to the internet, and left out the web port 443 rule, the instance swapped for a new image and the bucket tag edit. On the data-volume plan it gave the replaced disk, the encryption turned off and the server rebuilt only because its subnet id changes, and left out the database tag change and the subnet that was replaced for a new range. On the clean platform plan it answered exactly No findings.
- Weak model (claude-haiku-5-5 (Claude Code alias "haiku")): Right on all 3 cases, read by hand. It matched the strong model on both planted plans, with sound fixes, and kept every safe look-alike out of its list: the stateless instance, the tag edits, port 443 and the subnet that was replaced for a new range. On the clean plan it answered exactly No findings.

Note: Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three plan texts were written by us in the format of the Terraform plan page; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. The list of resource types that count as stateful is the skill's own policy. Facts come from public Terraform documentation, read on 26 October 2026; there are no owner-measured facts.

Full summary: https://aiskills402.com/skills/terraform-plan-risk-review/tests

## Example

### English (claude-sonnet-5-5)

Before:

> Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:   ~ update in-place -/+ destroy and then create replacement Terraform will perform the following actions:   # aws_db_instance.orders must be replaced -/+ resource "aws_db_instance" "orders" {…

After:

> STATEFUL-LOSS — aws_db_instance.orders, `db_subnet_group_name = "orders-a" -> "orders-b" # forces replacement` — the database instance is destroyed and recreated, so its data is lost — keep the original subnet group, or snapshot and restore the data before applying…

## What is in the file

- What the Terraform documentation says, as published on 26 October 2026
- The answer
- The codes
- Rules
- Work in this order
- Short example

## Languages

English

## How to buy

Agent (HTTP):

1. GET https://api.aiskills402.com/v1/skills/terraform-plan-risk-review/file without a payment header. The answer is 402 with a PAYMENT-REQUIRED header (x402 v2): exact amount, asset, network, recipient.
2. Sign `accepts[0]` with an x402 client (for example @x402/core + @x402/evm).
3. Repeat the GET with the signature in the PAYMENT-SIGNATURE header. The answer is 200 with the file, its sha256 and a re-download token.

Agent (MCP): https://mcp.aiskills402.com/mcp — free tools search_skills, get_skill, redownload_skill. Buying itself is over HTTP.

Full flow: https://aiskills402.com/docs

## The file

- Version: 1.0.0
- Size: 6.2 KB (6399 bytes)
- SHA-256: aae3dbeedb2ee2cb18c2830460099afa4a851eb7bb1f20e1c1a11f039237a6af
- Updated: 2026-10-26
- New versions are free through your re-download token.

## Versions

### 1.0.0 (2026-10-26)

First release, written in the light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description.

Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.

## License

Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Terms: https://aiskills402.com/docs#license

## FAQ

### Stateless server replaced for a new image: any line?

No. Replacing a server, a function or a subnet because of a literal value is ordinary change. Only a data-holding resource that is destroyed or replaced is reported, and a database that is merely resized or retagged in place is left alone.

### Is port 443 open to the whole internet reported?

No. Web ports 80 and 443 are accepted for a world-facing rule. A database, shell or remote desktop port open to anywhere, or a rule that opens every port, is the case that earns a line.

### What plans went into the test?

Three plan texts of our own making. One replaces a database and opens its port beside a harmless instance swap and a bucket tag edit. One drops disk encryption and rebuilds a server because a subnet id moves. The third is a clean platform plan. Both models were given each plan a single time.

### What does a harmless plan return?

Only the sentence No findings., with no extra remark. Any real problem becomes one line giving the code, the resource address, the damage and the repair, and nothing is said about the parts that were examined and found acceptable.

## Measurement limits

- Models other than the two named above were not run.
- Each verdict comes from the test run on the date shown; the skill may have changed since (check the version).
- Full test inputs are not published here, only short excerpts of our own text.
- Results on your own texts, languages and domains can differ.

Offer note: Paid in USDC (USD-pegged) over x402 by an AI agent; one-time.