How to use the Terraform Infrastructure Expert agent skill

What the Terraform skill makes the agent do

Terraform is a tool that defines cloud infrastructure such as servers, networks and databases as code. This skill gives the agent expert guidelines for working with Terraform and OpenTofu. Once installed, the agent follows safer habits: running a plan before applying changes, using remote state with locking, pinning provider versions, designing reusable modules and avoiding hardcoded secrets.

• Reviews plan output for unexpected changes before any apply
• Recommends remote state backends with state locking instead of local state for shared infrastructure
• Pins Terraform and provider versions with required_providers
• Suggests focused, reusable modules with typed, documented variables and outputs
• Advises on state tasks such as state list, state show, import and state mv
• Recommends tagging, for_each over count, locals and data sources

What the skill does not do

The skill is written as instructions and reference advice, not as a tool that changes your infrastructure by itself. It only contains guidance, so the agent still needs its own access and tools to run Terraform. It covers general principles rather than specific cloud APIs, so provider-specific details may need to come from elsewhere.

Install the Terraform skill

Download the skill ZIP from this page. The skill is a single file named SKILL.md. Unzip it into one of these locations, depending on whether you want it for all projects or one project:

• Personal: ~/.claude/skills/ (available across your projects)
• Project: a project's .claude/skills/ folder (available only in that project)
• Claude apps: upload the ZIP under Settings → Capabilities → Skills

Trigger the skill with natural requests

You do not need a special command. Describe the Terraform task in plain language and mention Terraform or OpenTofu. The skill is meant for writing, planning, reviewing and managing state, so requests along those lines are the ones it is built for.

• Review this Terraform config for hardcoded secrets and missing version pins
• Help me move an existing S3 bucket into Terraform with an import
• Refactor this module so the resource address changes without recreating the resource
• Suggest a module layout for networking and compute in separate modules
• Check whether my plan output shows anything risky before I apply

Before you start: what you need

The skill needs different things depending on what you ask the agent to do. Reading and reviewing code needs only the files. Running commands needs more.

• Terraform or OpenTofu installed, if the agent is to run commands
• Access to the target project and state backend, if the agent is to plan or apply
• Cloud provider credentials, only if you choose to run plans or applies against real infrastructure

Safety notes on scripts and network

This skill runs no scripts and uses no network. It is a text file of guidance. Any commands the agent runs come from Terraform itself and from the access you have given the agent, so limit that access to what you intend. The skill also advises against running terraform destroy in production without explicit confirmation and a reviewed plan, and against storing secrets in .tf files.

Tips for getting good results

The advice assumes working knowledge of cloud infrastructure, so give the agent real context: your provider, your backend and the environments you run. Paste the plan output when you want it reviewed. Treat the answers as a starting point and check them against your own provider documentation.

• Include the plan output and the relevant .tf files in your request
• Say which backend you use, such as S3 with DynamoDB or Terraform Cloud
• Ask for one concern at a time, such as state or module design