Skills Guide

Infrastructure Code Review

VerifiedSafe

Infrastructure Code Review performs a comprehensive review of infrastructure as code, CI/CD pipelines, migrations, logging, and observability. It spawns a senior review specialist agent that applies six specialized checklists to identify security misconfigurations, operational risks, and production readiness issues. This skill is particularly useful when reviewing changes to infrastructure files like Terraform, Kubernetes manifests, CI/CD configs, and database migrations.

Download and use
Sby Skills Guide Bot
DevOpsIntermediate
6/2/2026
Claude Code
#infrastructure#code-review#iac#ci-cd#observability

Recommended for

Backend developerClaude CodeCode reviewDevOps engineerGit automation

Automated summary

Performs a comprehensive infrastructure review by applying six checklists (IaC, CI/CD, releases, migrations, logging, observability) via a specialist agent.

Strengths

  • Broad coverage of infrastructure aspects (security, deployment, observability)
  • Detection of misconfigurations and operational risks
  • Blast radius assessment for production incidents
  • Structured output with clear priority levels

Limitations

  • Requires the agent to have access to infrastructure files and git diff context
  • May produce a high volume of comments on large changes
  • Depends on the quality of the loaded checklists
When to use it

Use this skill when reviewing infrastructure code changes (Terraform, CI/CD, migrations, logging) before production deployment.

When not to use it

Do not use it for application-only code changes without infrastructure components, or when a general code review without infrastructure focus is needed.

Security analysis

Safe
Quality score85/100

The skill only describes a review process and spawns a specialist agent; it does not execute any commands or access any tools directly, and contains no destructive or exfiltrating instructions.

No concerns found

How this analysis is made

Examples

Review infrastructure pull request
Run an infrastructure-focused review on the current branch using all checklists.
Assess production readiness of infrastructure changes
Perform a review of the infrastructure code changes in this PR, applying the infra, CI, release, migration, logging, and observability checklists. Provide a production readiness assessment.

name: review:infra description: Infrastructure-focused review covering IaC, CI/CD, releases, migrations, logging, and observability. Spawns the senior-review-specialist agent for infrastructure analysis.

Infrastructure Code Review

Run an infrastructure-focused review using 6 infrastructure checklists via the senior-review-specialist agent.

Instructions

Spawn the senior-review-specialist agent to perform this review.

Checklists to Apply

Load and apply these review checklists:

  • commands/review/infra.md - Deployment config, least privilege, operational clarity
  • commands/review/ci.md - Pipeline security, deployment safety
  • commands/review/release.md - Versioning, rollout, migration, rollback
  • commands/review/migrations.md - Database migration safety
  • commands/review/logging.md - Secrets exposure, PII leaks, wide-events
  • commands/review/observability.md - Logs, metrics, tracing, alertability

Agent Instructions

The agent should:

  1. Get working tree changes: Run git diff to see all changes
  2. Identify infrastructure files:
    • Terraform, CloudFormation, Kubernetes manifests
    • CI/CD pipelines (GitHub Actions, GitLab CI, etc.)
    • Migration files, deployment scripts
    • Logging and monitoring configuration
  3. For each changed file:
    • Read the full file content
    • Go through each diff hunk
    • Apply all 6 infrastructure checklists
    • Look for security misconfigurations and operational risks
  4. Cross-reference related files: Check environment configs, secrets handling
  5. Assess blast radius: What could go wrong in production?

Output Format

Generate an infrastructure review report with:

  • Critical Issues (BLOCKER): Security misconfigurations, deployment risks
  • High Priority Issues: Missing guardrails, cost explosions
  • Medium Priority Issues: Observability gaps, operational hazards
  • Infrastructure Map: Components, dependencies, deployment topology
  • Operational Readiness: Logging, alerting, rollback capabilities
  • File Summary: Infrastructure issues per file
  • Overall Assessment: Production readiness recommendation

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/infrastructure-code-review-mmh8qrha/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/infrastructure-code-review-mmh8qrha' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/infrastructure-code-review-mmh8qrha/download' --output '.skill-downloads/infrastructure-code-review-mmh8qrha/SKILL.md.part' && mv '.skill-downloads/infrastructure-code-review-mmh8qrha/SKILL.md.part' '.skill-downloads/infrastructure-code-review-mmh8qrha/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

This file does not provide a usable name/description header for this native procedure. It remains available to download and inspect; use the manual method below.

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/infrastructure-code-review-mmh8qrha/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

Configure a Chat Channel with SecretRefs

DevOps

Set up chat channels using non-interactive commands, with secrets only as SecretRefs. Covers gather, mutate, repair, and prove steps for reliable delivery.

Claude CodeCodexintermediateSafe 387,940
Skills Guide Bot

Investigate ClickHouse CI Failures

DevOps

Investigate a ClickHouse CI failure end-to-end from a PR or S3 report URL. Fetches failed tests, classifies flaky vs real regression, and checks for existing issues/fixes.

Claude CodeadvancedSafe 49,516
Skills Guide Bot

Ansible PR Review

DevOps

Reviews an Ansible PR following the project's standardized process, including changelog checks, test coverage validation, and feedback tracking.

Claude CodeintermediateSafe 70,491
Skills Guide Bot