Terraform skill from HashiCorp: what it does and how to install it

Source: hashicorp/agent-skills · Maintainer: HashiCorp · License: MPL-2.0 · Checked: 23 October 2026

What is the Terraform skill?

The Terraform skill, terraform-style-guide, is HashiCorp's official Agent Skill for making Claude Code, Codex and other agents write Terraform the way HashiCorp's own style guide says to: standard file layout, consistent formatting and naming, typed variables, pinned versions and safe handling of secrets. It is for anyone who lets an agent write or review .tf files and wants output that passes a human review without a cleanup pass.

It lives in hashicorp/agent-skills, which the README describes as "HashiCorp Agent Skills for Terraform and Packer": 16 Terraform skills and 4 Packer skills, all marked active in the repo's catalog. The skill's description reads: "Generate Terraform HCL code following HashiCorp's official style conventions and best practices. Use when writing, reviewing, or generating Terraform configurations."

As of 23 October 2026, its skills.sh page listed about 12,500 installs, with Pass results from Gen Agent Trust Hub, Socket and Snyk.

What does it do?

The SKILL.md is a condensed, agent-ready version of the HashiCorp Terraform Style Guide, with examples. The main rules:

• Generation order. Provider config and version constraints first, then data sources, then resources in dependency order, then outputs, with variables for every configurable value.
• File layout. terraform.tf for version requirements, providers.tf, main.tf for resources and data sources, variables.tf and outputs.tf in alphabetical order, and locals.tf.
• Formatting. Two spaces per nesting level, aligned equals signs, meta-arguments first, then arguments, then blocks, with lifecycle last.
• Naming. Lowercase with underscores, descriptive singular nouns that don't repeat the resource type, and main when there's only one.
• Variables and outputs. Every variable has type and description, with validation where useful; every output has description; secrets get sensitive = true.
• Dynamic resources. Prefer for_each over count for multiple named instances, and keep count for conditional creation.
• Version pinning. Use the latest major provider version and latest minor Terraform version unless a lock file or module says otherwise.
• Version control. Never commit state files, .terraform/, plan files or sensitive .tfvars; always commit .terraform.lock.hcl.
• Validation. Run terraform fmt -recursive and terraform validate before committing, with tflint and checkov or tfsec as extras. A review checklist closes the file.

The folder holds two files: SKILL.md and SECURITY.md. The security file adds hardening defaults (encryption at rest, private networking, least-privilege security groups, logging) and an order of preference for secrets. First choice is a resource's native secrets manager option, such as manage_master_user_password on RDS. Second is an ephemeral resource passed to a write-only attribute, so the secret stays out of state. Plain resources come last. It checks for Terraform 1.11.0 or later before using ephemeral resources.

What about the terraform-test skill?

Yes, terraform-test exists and is the natural partner. Its description calls it a "Comprehensive guide for writing and running Terraform tests." It covers .tftest.hcl files, run and assert blocks, plan versus apply mode, expect_failures for negative tests, parallel runs, state keys and cleanup order. Its folder adds references/MOCK_PROVIDERS.md, references/CI_CD.md (GitHub Actions and GitLab CI examples) and references/EXAMPLES.md (a full VPC module test suite). skills.sh listed it at about 8,800 installs.

Two version notes from the Terraform test docs: the test framework needs Terraform 1.6.0 or later, and provider mocking arrived in 1.7.0. The skill tells the agent to skip mocks below 1.7.

How do you install the Terraform skill?

The whole Terraform bundle in Claude Code. From the README:

claude plugin marketplace add hashicorp/agent-skills
claude plugin install terraform@hashicorp

That installs all 16 Terraform skills. Plugin skills are namespaced as /plugin-name:skill-name per the Claude Code skills docs, so this one is /terraform:terraform-style-guide. If you installed one of the older plugins such as terraform-code-generation, the README says to replace it with terraform@hashicorp.

One skill. The README uses the path form of the skills CLI:

npx skills add hashicorp/agent-skills/plugins/terraform/skills/terraform-style-guide
npx skills add hashicorp/agent-skills/plugins/terraform/skills/terraform-test

Add -g for all projects. Folders land in .claude/skills/<name>/, or ~/.claude/skills/<name>/ with -g. For Codex, the README says to add the repo's .agents/plugins/marketplace.json as a marketplace and install terraform. Codex and Cursor read the same SKILL.md format; see Codex skills and Cursor skills.

How do you use it?

Example prompts (suggestions, not quotes from the repo):

• Write Terraform for an S3 bucket with versioning, KMS encryption and public access blocked.
• Review modules/network against the HashiCorp style guide and fix what's off.
• Split this 600-line main.tf into the standard files and add descriptions to every variable.
• Our RDS password is a plain variable. Move it out of state using the secure pattern.
• Add plan-mode unit tests for the VPC module with mock providers. (uses terraform-test)

Requirements: the Terraform CLI for fmt and validate. tflint, checkov and tfsec are optional and only named, not configured. No API keys.

Tips and limits

From the files, not from testing:

• It's a style guide, not a planner. It doesn't cover state backends or workspaces. Other skills in the bundle go further: refactor-module turns a monolithic configuration into modules, terraform-stacks covers Terraform Stacks, and terraform-search-import brings existing cloud resources under Terraform.
• Examples lean AWS. The examples use the AWS provider; the rules themselves are provider-neutral.
• One gentle difference. The skill says prefer for_each over count; HashiCorp's style guide page also advises using count and for_each sparingly. Both can be true: use them when you need them, and pick for_each when you do.
• Apply mode costs money. In terraform-test, apply is the default and creates real resources. The skill recommends plan mode and mocks for unit tests.
• Model support. The repo's SUPPORTED_MODELS.md lists the Claude and GPT models HashiCorp evaluates the skills against; other models are "unsupported or unevaluated, not necessarily incompatible."
• License. MPL-2.0, a file-level copyleft: if you change these files and share them, share those files' source under MPL-2.0.

Save it in your Kipt library

In Kipt, open Skills and paste the skill's GitHub folder link into the import box. Kipt reads the SKILL.md and its files, including SECURITY.md; for a repo with many skills it shows a list to pick from, so you can take terraform-style-guide and terraform-test together. You can also drop the folder or a .zip, which makes it easy to add your team's naming and tagging rules to the skill. Your skills live in your own private GitHub repo and install into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with HashiCorp.

Similar skills

• Semgrep skill: Trail of Bits' scanner skill, whose ruleset catalog includes HashiCorp's Terraform rules.
• Dockerfile skill: the container side of the same infrastructure work.
• Security and hardening skill: secrets and least privilege for the app code your Terraform deploys.
• Best Claude Code skills: more skills worth installing.