{
  "id": "opentofu-module-checkov",
  "type": "loadout",
  "title": "OpenTofu modules gated by tofu test and Checkov",
  "summary": "Agents write OpenTofu modules that pass a local gate: fmt, a read-only lock file, tofu test with a mocked AWS provider, and Checkov with reasoned skips only.",
  "description": "Ask an agent for a bucket and you get a public ACL, no encryption and a Checkov skip with no reason, or a soft-fail flag that turns the scan into decoration. This loadout gives your agent a gate it runs before calling a module change done. It checks formatting, runs init against the committed lock file, validates, and runs tofu test against a mocked AWS provider, so no credentials are needed and nothing is created. Checkov runs last. It refuses soft-fail, repo-wide skip lists and inline skips without a reason. A complete S3 bucket module shows the target, with tests that check its secure defaults and every validation rule. A root example enforces OpenTofu's native state and plan encryption. The verifier runs it on OpenTofu 1.13.1, the AWS provider 6.69.1 and Checkov 3.3.29. It also checks that a reasonless skip, soft-fail, suspended versioning and an agent-written public bucket all fail.\n",
  "highlights": [
    "One gate script: fmt, read-only lock file, validate, tofu test, Checkov",
    "tofu test with mock_provider: no AWS credentials, nothing created",
    "Checkov exceptions only as inline skips with a reason; soft-fail refused",
    "Root example with OpenTofu state and plan encryption enforced",
    "Verified on OpenTofu 1.13.1, AWS provider 6.69.1 and Checkov 3.3.29"
  ],
  "version": "1.0.0",
  "license": "MIT",
  "author": {
    "name": "Agent Loadout",
    "url": "https://loadout.jnw-it.com"
  },
  "credits": [
    {
      "title": "OpenTofu docs: tofu test (mock providers)",
      "url": "https://opentofu.org/docs/cli/commands/test/"
    },
    {
      "title": "OpenTofu docs: state and plan encryption",
      "url": "https://opentofu.org/docs/language/state/encryption/"
    },
    {
      "title": "OpenTofu docs: dependency lock file",
      "url": "https://opentofu.org/docs/language/files/dependency-lock/"
    },
    {
      "title": "Checkov docs: suppressing and skipping policies",
      "url": "https://www.checkov.io/2.Basics/Suppressing%20and%20Skipping%20Policies.html"
    },
    {
      "title": "bridgecrewio/checkov",
      "url": "https://github.com/bridgecrewio/checkov"
    }
  ],
  "categories": [
    "security",
    "workflow"
  ],
  "stacks": [
    "opentofu",
    "terraform",
    "aws",
    "bash"
  ],
  "files": [
    {
      "path": "AGENTS.md",
      "role": "instructions",
      "description": "Rules for OpenTofu modules that pass fmt, validate, tofu test and Checkov before a person plans and applies.",
      "skill": null,
      "agent": null,
      "install_to": {
        "claude-code": "AGENTS.md",
        "codex": "AGENTS.md",
        "cursor": "AGENTS.md",
        "gemini-cli": "AGENTS.md",
        "antigravity-cli": "AGENTS.md",
        "copilot": "AGENTS.md"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/AGENTS.md",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/AGENTS.md",
      "bytes": 1754,
      "lang": "markdown",
      "content": "# AGENTS.md: OpenTofu modules gated by tofu test and Checkov\n\nInfrastructure as code in OpenTofu (HCL works the same in Terraform, with `terraform` for `tofu`). Check\n`required_providers` and the lock file before using a provider argument: AWS provider v6 split many bucket\nsettings into separate resources.\n\n## Commands\n- Format: `tofu fmt -recursive`.\n- Gate (run before calling a change done): `bash .agents/skills/tofu-module-gate/scripts/gate.sh <module-dir>`.\n  It runs fmt check, `tofu init -backend=false -lockfile=readonly`, `tofu validate`, `tofu test` and Checkov, and\n  needs no cloud credentials.\n- Done means: `gate: ok`, with a `run` block in `tests/` covering the behaviour you changed.\n\n## Rules\n- Use the `tofu-module-gate` skill for any change to `.tf` or `.tftest.hcl` files.\n- Never run `tofu apply`, `destroy`, `import`, `state` subcommands, `force-unlock` or `-auto-approve`, and never\n  read state files. A person plans against real accounts and applies.\n- Tests use `mock_provider`. Do not add real credentials, profiles or a backend to make a test pass.\n- Every variable has a description and a type; constrained inputs have a `validation` block and a test with\n  `expect_failures`.\n- Pin providers (`~>` on a minor version) and keep the committed lock file. Upgrading a provider is its own change,\n  stated in the summary.\n- Fix Checkov findings. An exception is an inline `#checkov:skip=<ID>:<reason>` on the resource, never\n  `soft-fail`, `--skip-check` or a repo-wide skip list.\n- Root modules enforce OpenTofu state and plan encryption, with the key from the environment or a KMS key\n  provider, never from a file.\n- Stateful resources (buckets, databases, keys) carry `prevent_destroy = true`. Renames use `moved` blocks.\n"
    },
    {
      "path": "CLAUDE.md",
      "role": "adapter",
      "description": "Imports AGENTS.md for Claude Code.",
      "skill": null,
      "agent": "claude-code",
      "install_to": {
        "claude-code": "CLAUDE.md",
        "codex": null,
        "cursor": null,
        "gemini-cli": null,
        "antigravity-cli": null,
        "copilot": null
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/CLAUDE.md",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/CLAUDE.md",
      "bytes": 408,
      "lang": "markdown",
      "content": "# CLAUDE.md\n\n@AGENTS.md\n\n## Claude Code notes\n\n- Skills from this loadout live in `.claude/skills/`: `tofu-module-gate`. Use them when their description matches the task.\n- Follow AGENTS.md above; where this file and AGENTS.md disagree, AGENTS.md wins.\n\n<!-- From the Agent Loadout \"OpenTofu modules gated by tofu test and Checkov\" v1.0.0 — https://loadout.jnw-it.com/loadouts/opentofu-module-checkov/ -->\n"
    },
    {
      "path": "GEMINI.md",
      "role": "adapter",
      "description": "Imports AGENTS.md for Gemini CLI.",
      "skill": null,
      "agent": "gemini-cli",
      "install_to": {
        "claude-code": null,
        "codex": null,
        "cursor": null,
        "gemini-cli": "GEMINI.md",
        "antigravity-cli": null,
        "copilot": null
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/GEMINI.md",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/GEMINI.md",
      "bytes": 409,
      "lang": "markdown",
      "content": "# GEMINI.md\n\n@./AGENTS.md\n\n## Gemini CLI notes\n\n- Skills from this loadout live in `.agents/skills/`: `tofu-module-gate`. Use them when their description matches the task.\n- Follow AGENTS.md above; where this file and AGENTS.md disagree, AGENTS.md wins.\n\n<!-- From the Agent Loadout \"OpenTofu modules gated by tofu test and Checkov\" v1.0.0 — https://loadout.jnw-it.com/loadouts/opentofu-module-checkov/ -->\n"
    },
    {
      "path": "skills/tofu-module-gate/SKILL.md",
      "role": "skill",
      "description": "Workflow, Checkov exception rules, lock file and state encryption.",
      "skill": "tofu-module-gate",
      "agent": null,
      "install_to": {
        "claude-code": ".claude/skills/tofu-module-gate/SKILL.md",
        "codex": ".agents/skills/tofu-module-gate/SKILL.md",
        "cursor": ".agents/skills/tofu-module-gate/SKILL.md",
        "gemini-cli": ".agents/skills/tofu-module-gate/SKILL.md",
        "antigravity-cli": ".agents/skills/tofu-module-gate/SKILL.md",
        "copilot": ".agents/skills/tofu-module-gate/SKILL.md"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/SKILL.md",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/skills/tofu-module-gate/SKILL.md",
      "bytes": 4087,
      "lang": "markdown",
      "content": "---\nname: tofu-module-gate\ndescription: Write or change an OpenTofu (or Terraform) module so it passes a local gate - fmt, validate, tofu test with a mocked provider, and Checkov with reasoned exceptions only. Use when adding or editing .tf files, module variables, tests, or Checkov skips.\n---\n\n# OpenTofu module gate\n\nA module change is done when `scripts/gate.sh` prints `gate: ok`. The gate needs no cloud\ncredentials and creates nothing: tests run against `mock_provider`, Checkov reads the HCL.\n\n## Workflow\n\n1. Read the module's variables, outputs and tests before editing. Keep one resource type per\n   concern (the bucket, its versioning, its encryption ...), as the AWS provider v6 expects.\n2. Make the change. Every new input gets a `description`, a `type`, and a `validation` block\n   when it has a valid range or format.\n3. Add or update a `run` block in `tests/*.tftest.hcl` for the behaviour you changed:\n   - `command = plan` with `assert` blocks for secure defaults and computed values;\n   - `expect_failures = [var.x]` for every validation rule you add.\n4. Run the gate on the module folder:\n\n   ```bash\n   TOFU=tofu bash .agents/skills/tofu-module-gate/scripts/gate.sh modules/s3-bucket\n   ```\n\n   It runs, in order, and stops at the first failure:\n   `tofu fmt -check -recursive`, `tofu init -backend=false -lockfile=readonly`, `tofu validate`,\n   `tofu test`, an audit of Checkov exceptions, then Checkov 3.3.29 (through `uvx`).\n5. Fix what failed. Report the gate output, not a summary of it.\n\n## Checkov findings\n\n- Fix the finding first. Most S3, IAM and logging findings have a one-resource fix.\n- If the finding is genuinely the caller's decision (replication, event notifications), skip it\n  inline on the resource, with a reason a reviewer can disagree with:\n\n  ```hcl\n  resource \"aws_s3_bucket\" \"this\" {\n    #checkov:skip=CKV_AWS_144:Cross-region replication is configured by callers that need it\n  ```\n\n- Never add `soft-fail: true` or a `skip-check:` list to the repository's Checkov config, and\n  never pass `--soft-fail` or `--skip-check` on the command line. The gate refuses both config\n  settings, and refuses a skip with no reason or a reason under 10 characters.\n- Start the repository config from `references/checkov.yaml`.\n\n## Lock file and providers\n\n- Pin providers with `~>` on a minor version in `required_providers`, and commit the lock file.\n  The gate runs init with `-lockfile=readonly`, so a provider change must be a deliberate\n  `tofu init -upgrade` that a human reviews in the diff.\n- For lock hashes on every platform the team uses:\n  `tofu providers lock -platform=linux_amd64 -platform=darwin_arm64`.\n- Never commit the `.terraform` folder, state files or plan files.\n\n## Root modules: encrypt state\n\nOpenTofu encrypts state and plan files natively. A root module that uses this module should\ncarry an `encryption` block with `enforced = true` for both state and plan, and take the key\nfrom the environment (a sensitive variable set by `TF_VAR_...`, or a KMS key provider). See\n`references/example-root.tf`. Never write the passphrase into a file.\n\n## What the agent does not do\n\n- No `tofu apply`, `destroy`, `import`, `state` subcommands or `-auto-approve`. A person applies.\n  Pair this loadout with terraform-plan-only for a hook that enforces it.\n- No `tofu plan` against a real account to \"check it works\": that is what the mocked tests are for.\n- No new provider or module source without saying so in the summary.\n\n## Files\n\n- `scripts/gate.sh`: the gate. Env: `TOFU` (default `tofu`), `CHECKOV` (default\n  `uvx --from checkov==3.3.29 checkov`).\n- `references/main.tf`, `references/variables.tf`, `references/outputs.tf`,\n  `references/versions.tf`: a private, versioned, SSE-KMS S3 bucket module with access logging,\n  TLS-only policy and noncurrent-version expiry. Checkov: 0 failed, 2 reasoned skips.\n- `references/bucket.tftest.hcl`: four `run` blocks with a mocked AWS provider.\n- `references/example-root.tf`: root module with enforced state and plan encryption.\n- `references/checkov.yaml`: repository Checkov config.\n"
    },
    {
      "path": "skills/tofu-module-gate/scripts/gate.sh",
      "role": "reference",
      "description": "fmt, init (read-only lock), validate, tofu test, exception audit, Checkov.",
      "skill": "tofu-module-gate",
      "agent": null,
      "install_to": {
        "claude-code": ".claude/skills/tofu-module-gate/scripts/gate.sh",
        "codex": ".agents/skills/tofu-module-gate/scripts/gate.sh",
        "cursor": ".agents/skills/tofu-module-gate/scripts/gate.sh",
        "gemini-cli": ".agents/skills/tofu-module-gate/scripts/gate.sh",
        "antigravity-cli": ".agents/skills/tofu-module-gate/scripts/gate.sh",
        "copilot": ".agents/skills/tofu-module-gate/scripts/gate.sh"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/scripts/gate.sh",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/skills/tofu-module-gate/scripts/gate.sh",
      "bytes": 2090,
      "lang": "markdown",
      "content": "#!/usr/bin/env bash\n# Module gate: fmt, init (lock file read-only), validate, tofu test, Checkov, and an audit of\n# Checkov exceptions. Runs no plan against real cloud accounts and never applies.\n# Usage: gate.sh [module-dir]   (default: current directory)\n# Env: TOFU (default tofu), CHECKOV (default: uvx --from checkov==3.3.29 checkov)\nset -uo pipefail\n\ndir=\"${1:-.}\"\nTOFU=\"${TOFU:-tofu}\"\nCHECKOV=\"${CHECKOV:-uvx --from checkov==3.3.29 checkov}\"\ncd \"$dir\" || { echo \"gate: no such directory: $dir\"; exit 2; }\n\nfail() { echo \"gate: FAILED at $1\"; exit 1; }\nstep() { echo \"== $1\"; }\n\nstep \"fmt\"\n\"$TOFU\" fmt -check -recursive -diff -no-color || fail \"fmt (run: tofu fmt -recursive)\"\n\nstep \"init\"\n[ -f .terraform.lock.hcl ] || fail \"init (no .terraform.lock.hcl: run tofu init and commit the lock file)\"\n\"$TOFU\" init -backend=false -input=false -lockfile=readonly -no-color >/dev/null || fail \"init\"\n\nstep \"validate\"\n\"$TOFU\" validate -no-color || fail \"validate\"\n\nstep \"test\"\nif ls tests/*.tftest.hcl >/dev/null 2>&1; then\n  \"$TOFU\" test -no-color || fail \"test\"\nelse\n  fail \"test (no tests/*.tftest.hcl)\"\nfi\n\nstep \"exception audit\"\nbad=0\nif [ -f .checkov.yaml ] && grep -Eq '^[[:space:]]*(soft-fail|soft_fail)[[:space:]]*:[[:space:]]*true' .checkov.yaml; then\n  echo \"soft-fail is set in .checkov.yaml: findings would not fail the run\"; bad=1\nfi\nif [ -f .checkov.yaml ] && grep -Eq '^[[:space:]]*skip-check[[:space:]]*:' .checkov.yaml; then\n  echo \"skip-check in .checkov.yaml hides checks repo-wide: use an inline skip with a reason\"; bad=1\nfi\nwhile IFS= read -r hit; do\n  reason=\"${hit#*checkov:skip=}\"; reason=\"${reason#*:}\"\n  if [ \"$reason\" = \"${hit#*checkov:skip=}\" ] || [ \"${#reason}\" -lt 10 ]; then\n    echo \"skip without a reason: $hit\"; bad=1\n  fi\ndone < <(grep -rn --include='*.tf' 'checkov:skip=' . | grep -v '/\\.terraform/')\n[ \"$bad\" -eq 0 ] || fail \"exception audit\"\n\nstep \"checkov\"\ncfg=()\n[ -f .checkov.yaml ] && cfg=(--config-file .checkov.yaml)\n# shellcheck disable=SC2086\n$CHECKOV -d . \"${cfg[@]}\" --framework terraform --compact --quiet || fail \"checkov\"\n\necho \"gate: ok\"\n"
    },
    {
      "path": "skills/tofu-module-gate/references/main.tf",
      "role": "reference",
      "description": "Private, versioned, SSE-KMS S3 bucket with logging and a TLS-only policy.",
      "skill": "tofu-module-gate",
      "agent": null,
      "install_to": {
        "claude-code": ".claude/skills/tofu-module-gate/references/main.tf",
        "codex": ".agents/skills/tofu-module-gate/references/main.tf",
        "cursor": ".agents/skills/tofu-module-gate/references/main.tf",
        "gemini-cli": ".agents/skills/tofu-module-gate/references/main.tf",
        "antigravity-cli": ".agents/skills/tofu-module-gate/references/main.tf",
        "copilot": ".agents/skills/tofu-module-gate/references/main.tf"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/main.tf",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/skills/tofu-module-gate/references/main.tf",
      "bytes": 2557,
      "lang": "markdown",
      "content": "# Private, versioned, KMS-encrypted bucket with access logging and an expiry rule for old versions.\n# Checkov CKV_AWS_144 (cross-region replication) and CKV2_AWS_62 (event notifications) are skipped\n# with a reason: both are per-workload decisions made by the caller, not by this module.\nresource \"aws_s3_bucket\" \"this\" {\n  #checkov:skip=CKV_AWS_144:Cross-region replication is configured by callers that need it\n  #checkov:skip=CKV2_AWS_62:Event notifications are wired up by the consuming service\n  bucket = var.name\n  tags   = var.tags\n\n  lifecycle {\n    prevent_destroy = true\n  }\n}\n\nresource \"aws_s3_bucket_ownership_controls\" \"this\" {\n  bucket = aws_s3_bucket.this.id\n\n  rule {\n    object_ownership = \"BucketOwnerEnforced\"\n  }\n}\n\nresource \"aws_s3_bucket_public_access_block\" \"this\" {\n  bucket                  = aws_s3_bucket.this.id\n  block_public_acls       = true\n  block_public_policy     = true\n  ignore_public_acls      = true\n  restrict_public_buckets = true\n}\n\nresource \"aws_s3_bucket_versioning\" \"this\" {\n  bucket = aws_s3_bucket.this.id\n\n  versioning_configuration {\n    status = \"Enabled\"\n  }\n}\n\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"this\" {\n  bucket = aws_s3_bucket.this.id\n\n  rule {\n    apply_server_side_encryption_by_default {\n      sse_algorithm     = \"aws:kms\"\n      kms_master_key_id = var.kms_key_arn\n    }\n    bucket_key_enabled = true\n  }\n}\n\nresource \"aws_s3_bucket_logging\" \"this\" {\n  bucket        = aws_s3_bucket.this.id\n  target_bucket = var.log_bucket\n  target_prefix = \"s3/${var.name}/\"\n}\n\nresource \"aws_s3_bucket_lifecycle_configuration\" \"this\" {\n  bucket = aws_s3_bucket.this.id\n\n  rule {\n    id     = \"expire-noncurrent\"\n    status = \"Enabled\"\n\n    filter {}\n\n    noncurrent_version_expiration {\n      noncurrent_days = var.noncurrent_days\n    }\n\n    abort_incomplete_multipart_upload {\n      days_after_initiation = 7\n    }\n  }\n\n  depends_on = [aws_s3_bucket_versioning.this]\n}\n\ndata \"aws_iam_policy_document\" \"tls_only\" {\n  statement {\n    sid     = \"DenyInsecureTransport\"\n    effect  = \"Deny\"\n    actions = [\"s3:*\"]\n    resources = [\n      aws_s3_bucket.this.arn,\n      \"${aws_s3_bucket.this.arn}/*\",\n    ]\n\n    principals {\n      type        = \"*\"\n      identifiers = [\"*\"]\n    }\n\n    condition {\n      test     = \"Bool\"\n      variable = \"aws:SecureTransport\"\n      values   = [\"false\"]\n    }\n  }\n}\n\nresource \"aws_s3_bucket_policy\" \"tls_only\" {\n  bucket = aws_s3_bucket.this.id\n  policy = data.aws_iam_policy_document.tls_only.json\n\n  depends_on = [aws_s3_bucket_public_access_block.this]\n}\n"
    },
    {
      "path": "skills/tofu-module-gate/references/variables.tf",
      "role": "reference",
      "description": "Typed, described inputs with validation blocks.",
      "skill": "tofu-module-gate",
      "agent": null,
      "install_to": {
        "claude-code": ".claude/skills/tofu-module-gate/references/variables.tf",
        "codex": ".agents/skills/tofu-module-gate/references/variables.tf",
        "cursor": ".agents/skills/tofu-module-gate/references/variables.tf",
        "gemini-cli": ".agents/skills/tofu-module-gate/references/variables.tf",
        "antigravity-cli": ".agents/skills/tofu-module-gate/references/variables.tf",
        "copilot": ".agents/skills/tofu-module-gate/references/variables.tf"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/variables.tf",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/skills/tofu-module-gate/references/variables.tf",
      "bytes": 1177,
      "lang": "markdown",
      "content": "variable \"name\" {\n  description = \"Bucket name. Globally unique, lower case, 3 to 63 characters.\"\n  type        = string\n\n  validation {\n    condition     = can(regex(\"^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$\", var.name))\n    error_message = \"name must be 3-63 lower-case letters, digits, dots or hyphens, starting and ending with a letter or digit.\"\n  }\n}\n\nvariable \"kms_key_arn\" {\n  description = \"ARN of the customer-managed KMS key used for default encryption.\"\n  type        = string\n\n  validation {\n    condition     = startswith(var.kms_key_arn, \"arn:aws:kms:\")\n    error_message = \"kms_key_arn must be a KMS key ARN.\"\n  }\n}\n\nvariable \"log_bucket\" {\n  description = \"Name of the bucket that receives server access logs.\"\n  type        = string\n}\n\nvariable \"noncurrent_days\" {\n  description = \"Days to keep noncurrent object versions before they expire.\"\n  type        = number\n  default     = 90\n\n  validation {\n    condition     = var.noncurrent_days >= 7 && var.noncurrent_days <= 3650\n    error_message = \"noncurrent_days must be between 7 and 3650.\"\n  }\n}\n\nvariable \"tags\" {\n  description = \"Tags added to every resource.\"\n  type        = map(string)\n  default     = {}\n}\n"
    },
    {
      "path": "skills/tofu-module-gate/references/outputs.tf",
      "role": "reference",
      "description": "Module outputs.",
      "skill": "tofu-module-gate",
      "agent": null,
      "install_to": {
        "claude-code": ".claude/skills/tofu-module-gate/references/outputs.tf",
        "codex": ".agents/skills/tofu-module-gate/references/outputs.tf",
        "cursor": ".agents/skills/tofu-module-gate/references/outputs.tf",
        "gemini-cli": ".agents/skills/tofu-module-gate/references/outputs.tf",
        "antigravity-cli": ".agents/skills/tofu-module-gate/references/outputs.tf",
        "copilot": ".agents/skills/tofu-module-gate/references/outputs.tf"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/outputs.tf",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/skills/tofu-module-gate/references/outputs.tf",
      "bytes": 172,
      "lang": "markdown",
      "content": "output \"id\" {\n  description = \"Bucket name.\"\n  value       = aws_s3_bucket.this.id\n}\n\noutput \"arn\" {\n  description = \"Bucket ARN.\"\n  value       = aws_s3_bucket.this.arn\n}\n"
    },
    {
      "path": "skills/tofu-module-gate/references/versions.tf",
      "role": "reference",
      "description": "OpenTofu and AWS provider version constraints.",
      "skill": "tofu-module-gate",
      "agent": null,
      "install_to": {
        "claude-code": ".claude/skills/tofu-module-gate/references/versions.tf",
        "codex": ".agents/skills/tofu-module-gate/references/versions.tf",
        "cursor": ".agents/skills/tofu-module-gate/references/versions.tf",
        "gemini-cli": ".agents/skills/tofu-module-gate/references/versions.tf",
        "antigravity-cli": ".agents/skills/tofu-module-gate/references/versions.tf",
        "copilot": ".agents/skills/tofu-module-gate/references/versions.tf"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/versions.tf",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/skills/tofu-module-gate/references/versions.tf",
      "bytes": 151,
      "lang": "markdown",
      "content": "terraform {\n  required_version = \">= 1.10.0\"\n\n  required_providers {\n    aws = {\n      source  = \"hashicorp/aws\"\n      version = \"~> 6.69\"\n    }\n  }\n}\n"
    },
    {
      "path": "skills/tofu-module-gate/references/bucket.tftest.hcl",
      "role": "reference",
      "description": "Four tofu test runs against a mocked AWS provider.",
      "skill": "tofu-module-gate",
      "agent": null,
      "install_to": {
        "claude-code": ".claude/skills/tofu-module-gate/references/bucket.tftest.hcl",
        "codex": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl",
        "cursor": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl",
        "gemini-cli": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl",
        "antigravity-cli": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl",
        "copilot": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/bucket.tftest.hcl",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/skills/tofu-module-gate/references/bucket.tftest.hcl",
      "bytes": 2023,
      "lang": "markdown",
      "content": "# Runs with `tofu test`: a mocked AWS provider, so no credentials, no API calls, nothing created.\nmock_provider \"aws\" {\n  mock_data \"aws_iam_policy_document\" {\n    defaults = {\n      json = \"{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[]}\"\n    }\n  }\n}\n\nvariables {\n  name        = \"acme-reports-eu\"\n  kms_key_arn = \"arn:aws:kms:eu-west-2:111122223333:key/0d7c2f4e-1111-2222-3333-444455556666\"\n  log_bucket  = \"acme-access-logs\"\n}\n\nrun \"secure_defaults\" {\n  command = plan\n\n  assert {\n    condition     = aws_s3_bucket_versioning.this.versioning_configuration[0].status == \"Enabled\"\n    error_message = \"Versioning must be enabled.\"\n  }\n\n  assert {\n    condition = alltrue([\n      aws_s3_bucket_public_access_block.this.block_public_acls,\n      aws_s3_bucket_public_access_block.this.block_public_policy,\n      aws_s3_bucket_public_access_block.this.ignore_public_acls,\n      aws_s3_bucket_public_access_block.this.restrict_public_buckets,\n    ])\n    error_message = \"All four public access block settings must be true.\"\n  }\n\n  assert {\n    condition     = one([for r in aws_s3_bucket_server_side_encryption_configuration.this.rule : one(r.apply_server_side_encryption_by_default).sse_algorithm]) == \"aws:kms\"\n    error_message = \"Default encryption must be SSE-KMS.\"\n  }\n\n  assert {\n    condition     = aws_s3_bucket_ownership_controls.this.rule[0].object_ownership == \"BucketOwnerEnforced\"\n    error_message = \"ACLs must be disabled (BucketOwnerEnforced).\"\n  }\n\n  assert {\n    condition     = aws_s3_bucket_logging.this.target_prefix == \"s3/acme-reports-eu/\"\n    error_message = \"Access logs must go under s3/<name>/.\"\n  }\n}\n\nrun \"rejects_bad_name\" {\n  command = plan\n\n  variables {\n    name = \"Acme_Reports\"\n  }\n\n  expect_failures = [var.name]\n}\n\nrun \"rejects_non_kms_key\" {\n  command = plan\n\n  variables {\n    kms_key_arn = \"alias/aws/s3\"\n  }\n\n  expect_failures = [var.kms_key_arn]\n}\n\nrun \"rejects_short_retention\" {\n  command = plan\n\n  variables {\n    noncurrent_days = 1\n  }\n\n  expect_failures = [var.noncurrent_days]\n}\n"
    },
    {
      "path": "skills/tofu-module-gate/references/example-root.tf",
      "role": "reference",
      "description": "Root module with enforced state and plan encryption.",
      "skill": "tofu-module-gate",
      "agent": null,
      "install_to": {
        "claude-code": ".claude/skills/tofu-module-gate/references/example-root.tf",
        "codex": ".agents/skills/tofu-module-gate/references/example-root.tf",
        "cursor": ".agents/skills/tofu-module-gate/references/example-root.tf",
        "gemini-cli": ".agents/skills/tofu-module-gate/references/example-root.tf",
        "antigravity-cli": ".agents/skills/tofu-module-gate/references/example-root.tf",
        "copilot": ".agents/skills/tofu-module-gate/references/example-root.tf"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/example-root.tf",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/skills/tofu-module-gate/references/example-root.tf",
      "bytes": 1272,
      "lang": "markdown",
      "content": "# Root module example: calls the bucket module and encrypts state and plan files with\n# OpenTofu's built-in state encryption. The passphrase comes from a variable that is\n# set in the environment (TF_VAR_state_passphrase), never written to a file.\nterraform {\n  required_version = \">= 1.10.0\"\n\n  required_providers {\n    aws = {\n      source  = \"hashicorp/aws\"\n      version = \"~> 6.69\"\n    }\n  }\n\n  encryption {\n    key_provider \"pbkdf2\" \"state\" {\n      passphrase = var.state_passphrase\n    }\n\n    method \"aes_gcm\" \"state\" {\n      keys = key_provider.pbkdf2.state\n    }\n\n    state {\n      method   = method.aes_gcm.state\n      enforced = true\n    }\n\n    plan {\n      method   = method.aes_gcm.state\n      enforced = true\n    }\n  }\n}\n\nvariable \"state_passphrase\" {\n  description = \"State encryption passphrase, at least 16 characters. Set TF_VAR_state_passphrase.\"\n  type        = string\n  sensitive   = true\n}\n\nprovider \"aws\" {\n  region = \"eu-west-2\"\n}\n\nmodule \"reports\" {\n  source = \"../../modules/s3-bucket\"\n\n  name        = \"acme-reports-eu\"\n  kms_key_arn = \"arn:aws:kms:eu-west-2:111122223333:key/0d7c2f4e-1111-2222-3333-444455556666\"\n  log_bucket  = \"acme-access-logs\"\n  tags        = { service = \"reports\" }\n}\n\noutput \"bucket_arn\" {\n  value = module.reports.arn\n}\n"
    },
    {
      "path": "skills/tofu-module-gate/references/checkov.yaml",
      "role": "reference",
      "description": "Repository Checkov config with no soft-fail or skip list.",
      "skill": "tofu-module-gate",
      "agent": null,
      "install_to": {
        "claude-code": ".claude/skills/tofu-module-gate/references/checkov.yaml",
        "codex": ".agents/skills/tofu-module-gate/references/checkov.yaml",
        "cursor": ".agents/skills/tofu-module-gate/references/checkov.yaml",
        "gemini-cli": ".agents/skills/tofu-module-gate/references/checkov.yaml",
        "antigravity-cli": ".agents/skills/tofu-module-gate/references/checkov.yaml",
        "copilot": ".agents/skills/tofu-module-gate/references/checkov.yaml"
      },
      "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/checkov.yaml",
      "raw_latest_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/latest/skills/tofu-module-gate/references/checkov.yaml",
      "bytes": 347,
      "lang": "yaml",
      "content": "# Repository .checkov.yaml. Findings fail the run: no soft-fail, no skip-check list.\n# Accepted exceptions are inline `#checkov:skip=<ID>:<reason>` comments next to the resource,\n# so the reason is reviewed in the same diff as the code.\nframework:\n  - terraform\ncompact: true\nquiet: true\ndownload-external-modules: false\nskip-path:\n  - .terraform\n"
    }
  ],
  "requires": {
    "tools": [
      "tofu",
      "uv"
    ],
    "env": [],
    "mcp": []
  },
  "tested": {
    "status": "untested",
    "last_run": null,
    "fixture": null,
    "per_agent": {
      "claude-code": "untested",
      "codex": "untested",
      "cursor": "untested",
      "gemini-cli": "untested",
      "antigravity-cli": "untested",
      "copilot": "untested"
    }
  },
  "security": {
    "scanned": true,
    "scanner": "intake-precheck/1",
    "verdict": "clean",
    "network": true,
    "scripts": [
      "gate.sh"
    ],
    "notes": "tofu init downloads the hashicorp/aws provider from the OpenTofu registry, checked against the committed lock file. uvx downloads Checkov 3.3.29 from PyPI. Tests use a mocked provider: no credentials, no cloud API calls."
  },
  "featured": false,
  "deprecated": false,
  "last_checked": "2026-10-17",
  "published": "2026-10-17",
  "updated": "2026-10-17",
  "compatibility": {
    "claude-code": "native",
    "codex": "native",
    "cursor": "native",
    "gemini-cli": "native",
    "antigravity-cli": "native",
    "copilot": "native"
  },
  "counts": {
    "rules": 1,
    "skills": 1,
    "mcp": 0
  },
  "url": "https://loadout.jnw-it.com/loadouts/opentofu-module-checkov/",
  "api_url": "https://loadout.jnw-it.com/api/loadouts/opentofu-module-checkov.json",
  "verification": {
    "level": "verified-install",
    "status": "verified",
    "label": "Verified install",
    "verified": true,
    "checked_at": "2026-10-17T20:59:33Z",
    "commit": "08c3710727a4d6fc320a98ecf32bdc0a780eaa6c",
    "content_current": true,
    "agent_tests": "not-run",
    "counts": {
      "pass": 9,
      "fail": 0,
      "skip": 0,
      "not_applicable": 1
    },
    "meaning": "Level 1: automated checks on the files (parse, install paths, MCP config, safety scan, references, size, licence, starter build). No AI agent was run.",
    "checks": [
      {
        "id": "listing",
        "name": "Listing",
        "status": "pass",
        "summary": "Schema valid; 12 files declared, none missing or extra",
        "details": [
          "tested.status: untested (agent tests are separate from Level 1)"
        ]
      },
      {
        "id": "parse",
        "name": "Files parse",
        "status": "pass",
        "summary": "All 12 files parse; front matter valid",
        "details": []
      },
      {
        "id": "adapters",
        "name": "Adapters",
        "status": "pass",
        "summary": "CLAUDE.md and GEMINI.md import AGENTS.md and are up to date",
        "details": [
          "CLAUDE.md: matches the generator",
          "GEMINI.md: matches the generator"
        ]
      },
      {
        "id": "install-paths",
        "name": "Install paths",
        "status": "pass",
        "summary": "Correct paths for all 6 agents; layouts re-discovered",
        "details": [
          "Claude Code: 11 files, 1 skill in .claude/skills/",
          "Codex CLI: 10 files, 1 skill in .agents/skills/",
          "Cursor: 10 files, 1 skill in .agents/skills/",
          "Gemini CLI: 11 files, 1 skill in .agents/skills/",
          "Antigravity CLI: 10 files, 1 skill in .agents/skills/",
          "GitHub Copilot: 10 files, 1 skill in .agents/skills/"
        ]
      },
      {
        "id": "mcp",
        "name": "MCP config",
        "status": "n/a",
        "summary": "No MCP servers in this loadout",
        "details": []
      },
      {
        "id": "safety",
        "name": "Safety scan",
        "status": "pass",
        "summary": "Clean: no credentials, risky shell or hidden text",
        "details": [
          "Scanner intake-precheck/1: verdict clean; network yes (listing says yes)"
        ]
      },
      {
        "id": "references",
        "name": "References",
        "status": "pass",
        "summary": "2 references between files resolve for every agent",
        "details": []
      },
      {
        "id": "size",
        "name": "Size limits",
        "status": "pass",
        "summary": "12 files, 16.1 KB total; largest skills/tofu-module-gate/SKILL.md 4.0 KB",
        "details": [
          "Limits: 30 files, 32 KB per file, 128 KB total, 500 lines per skill or rule"
        ]
      },
      {
        "id": "licence",
        "name": "Licence",
        "status": "pass",
        "summary": "MIT, by Agent Loadout; text in the repository LICENSE",
        "details": []
      },
      {
        "id": "starter-build",
        "name": "Starter build",
        "status": "pass",
        "summary": "The tofu-module-gate skill's S3 bucket module passes gate.sh on OpenTofu 1.13.1 with the AWS provider mocked (fmt, read-only lock file, validate, four tofu test runs) and Checkov 3.3.29 with two reasoned skips; the state-encrypted root example validates; a reasonless skip, soft-fail, suspended versi",
        "details": [
          "Applied 21 loadout files at every agent's paths",
          "tofu 1.13.1",
          "✓ place the skill's module, tests, example and Checkov config: bash -c R=.agents/skills/tofu-module-gate/references; M=modules/s3-bucket; mkdir -p $M/tests && cp $R/main.tf $R/variables.tf $R/outputs.tf $R/versions.tf $M/ && cp $R/bucket.tftest.hcl $M/tests/ && cp $R/example-root.tf examples/basic/main.tf && cp $R/checkov.yaml $M/.checkov.yaml && bash -n .agents/skills/tofu-module-gate/scripts/gate.sh && echo placed",
          "✓ gate.sh passes on the module (mocked provider, no credentials): bash -c export TOFU=\"$TOFU_BIN\" TF_PLUGIN_CACHE_DIR=\"$AL_TOOL_CACHE/tofu-plugins\"; mkdir -p \"$TF_PLUGIN_CACHE_DIR\"; unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_PROFILE; bash .agents/skills/tofu-module-gate/scripts/gate.sh modules/s3-bucket",
          "✓ the state-encrypted root example validates: bash -c export TF_PLUGIN_CACHE_DIR=\"$AL_TOOL_CACHE/tofu-plugins\"; cd examples/basic && \"$TOFU_BIN\" init -backend=false -input=false -lockfile=readonly -no-color >/dev/null && \"$TOFU_BIN\" validate -no-color",
          "✓ a skip without a reason and soft-fail are refused: bash -c export TOFU=\"$TOFU_BIN\" TF_PLUGIN_CACHE_DIR=\"$AL_TOOL_CACHE/tofu-plugins\"; rm -rf m && cp -r modules/s3-bucket m && rm -rf m/.terraform && sed -i 's/#checkov:skip=CKV_AWS_144:.*/#checkov:skip=CKV_AWS_144/' m/main.tf && echo 'soft-fail: true' >> m/.checkov.yaml && bash .agents/skills/tofu-module-gate/scripts/gate.sh m; test $? -eq 1 && echo refused",
          "✓ suspended versioning fails tofu test: bash -c export TOFU=\"$TOFU_BIN\" TF_PLUGIN_CACHE_DIR=\"$AL_TOOL_CACHE/tofu-plugins\"; rm -rf m && cp -r modules/s3-bucket m && rm -rf m/.terraform && sed -i '/versioning_configuration {/,/}/ s/\"Enabled\"/\"Suspended\"/' m/main.tf && grep -q Suspended m/main.tf && bash .agents/skills/tofu-module-gate/scripts/gate.sh m; test $? -eq 1 && echo caught",
          "✓ Checkov fails the agent-written public bucket: bash -c uvx --from checkov==3.3.29 checkov -d bad --framework terraform --compact --quiet; test $? -ne 0 && echo flagged",
          "Covers: tofu fmt -check, init with a committed read-only lock file, validate and tofu test with mock_provider (no AWS credentials)",
          "Covers: Variable validation tested with expect_failures; secure defaults asserted on the plan",
          "Covers: OpenTofu state and plan encryption (pbkdf2 + aes_gcm, enforced) in the root example",
          "Covers: Checkov exceptions only as inline skips with a reason; soft-fail and repo-wide skip-check refused"
        ]
      }
    ]
  },
  "install": {
    "claude-code": {
      "files": [
        {
          "path": "AGENTS.md",
          "target": "AGENTS.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/AGENTS.md",
          "role": "instructions"
        },
        {
          "path": "CLAUDE.md",
          "target": "CLAUDE.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/CLAUDE.md",
          "role": "adapter"
        },
        {
          "path": "skills/tofu-module-gate/SKILL.md",
          "target": ".claude/skills/tofu-module-gate/SKILL.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/SKILL.md",
          "role": "skill"
        },
        {
          "path": "skills/tofu-module-gate/scripts/gate.sh",
          "target": ".claude/skills/tofu-module-gate/scripts/gate.sh",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/scripts/gate.sh",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/main.tf",
          "target": ".claude/skills/tofu-module-gate/references/main.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/main.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/variables.tf",
          "target": ".claude/skills/tofu-module-gate/references/variables.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/variables.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/outputs.tf",
          "target": ".claude/skills/tofu-module-gate/references/outputs.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/outputs.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/versions.tf",
          "target": ".claude/skills/tofu-module-gate/references/versions.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/versions.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/bucket.tftest.hcl",
          "target": ".claude/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/example-root.tf",
          "target": ".claude/skills/tofu-module-gate/references/example-root.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/example-root.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/checkov.yaml",
          "target": ".claude/skills/tofu-module-gate/references/checkov.yaml",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/checkov.yaml",
          "role": "reference"
        }
      ],
      "manual_steps": [],
      "zip_url": "https://loadout.jnw-it.com/download/opentofu-module-checkov/claude-code.zip"
    },
    "codex": {
      "files": [
        {
          "path": "AGENTS.md",
          "target": "AGENTS.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/AGENTS.md",
          "role": "instructions"
        },
        {
          "path": "skills/tofu-module-gate/SKILL.md",
          "target": ".agents/skills/tofu-module-gate/SKILL.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/SKILL.md",
          "role": "skill"
        },
        {
          "path": "skills/tofu-module-gate/scripts/gate.sh",
          "target": ".agents/skills/tofu-module-gate/scripts/gate.sh",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/scripts/gate.sh",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/main.tf",
          "target": ".agents/skills/tofu-module-gate/references/main.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/main.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/variables.tf",
          "target": ".agents/skills/tofu-module-gate/references/variables.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/variables.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/outputs.tf",
          "target": ".agents/skills/tofu-module-gate/references/outputs.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/outputs.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/versions.tf",
          "target": ".agents/skills/tofu-module-gate/references/versions.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/versions.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/bucket.tftest.hcl",
          "target": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/example-root.tf",
          "target": ".agents/skills/tofu-module-gate/references/example-root.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/example-root.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/checkov.yaml",
          "target": ".agents/skills/tofu-module-gate/references/checkov.yaml",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/checkov.yaml",
          "role": "reference"
        }
      ],
      "manual_steps": [],
      "zip_url": "https://loadout.jnw-it.com/download/opentofu-module-checkov/codex.zip"
    },
    "cursor": {
      "files": [
        {
          "path": "AGENTS.md",
          "target": "AGENTS.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/AGENTS.md",
          "role": "instructions"
        },
        {
          "path": "skills/tofu-module-gate/SKILL.md",
          "target": ".agents/skills/tofu-module-gate/SKILL.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/SKILL.md",
          "role": "skill"
        },
        {
          "path": "skills/tofu-module-gate/scripts/gate.sh",
          "target": ".agents/skills/tofu-module-gate/scripts/gate.sh",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/scripts/gate.sh",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/main.tf",
          "target": ".agents/skills/tofu-module-gate/references/main.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/main.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/variables.tf",
          "target": ".agents/skills/tofu-module-gate/references/variables.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/variables.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/outputs.tf",
          "target": ".agents/skills/tofu-module-gate/references/outputs.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/outputs.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/versions.tf",
          "target": ".agents/skills/tofu-module-gate/references/versions.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/versions.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/bucket.tftest.hcl",
          "target": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/example-root.tf",
          "target": ".agents/skills/tofu-module-gate/references/example-root.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/example-root.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/checkov.yaml",
          "target": ".agents/skills/tofu-module-gate/references/checkov.yaml",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/checkov.yaml",
          "role": "reference"
        }
      ],
      "manual_steps": [],
      "zip_url": "https://loadout.jnw-it.com/download/opentofu-module-checkov/cursor.zip"
    },
    "gemini-cli": {
      "files": [
        {
          "path": "AGENTS.md",
          "target": "AGENTS.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/AGENTS.md",
          "role": "instructions"
        },
        {
          "path": "GEMINI.md",
          "target": "GEMINI.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/GEMINI.md",
          "role": "adapter"
        },
        {
          "path": "skills/tofu-module-gate/SKILL.md",
          "target": ".agents/skills/tofu-module-gate/SKILL.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/SKILL.md",
          "role": "skill"
        },
        {
          "path": "skills/tofu-module-gate/scripts/gate.sh",
          "target": ".agents/skills/tofu-module-gate/scripts/gate.sh",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/scripts/gate.sh",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/main.tf",
          "target": ".agents/skills/tofu-module-gate/references/main.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/main.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/variables.tf",
          "target": ".agents/skills/tofu-module-gate/references/variables.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/variables.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/outputs.tf",
          "target": ".agents/skills/tofu-module-gate/references/outputs.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/outputs.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/versions.tf",
          "target": ".agents/skills/tofu-module-gate/references/versions.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/versions.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/bucket.tftest.hcl",
          "target": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/example-root.tf",
          "target": ".agents/skills/tofu-module-gate/references/example-root.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/example-root.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/checkov.yaml",
          "target": ".agents/skills/tofu-module-gate/references/checkov.yaml",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/checkov.yaml",
          "role": "reference"
        }
      ],
      "manual_steps": [],
      "zip_url": "https://loadout.jnw-it.com/download/opentofu-module-checkov/gemini-cli.zip"
    },
    "antigravity-cli": {
      "files": [
        {
          "path": "AGENTS.md",
          "target": "AGENTS.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/AGENTS.md",
          "role": "instructions"
        },
        {
          "path": "skills/tofu-module-gate/SKILL.md",
          "target": ".agents/skills/tofu-module-gate/SKILL.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/SKILL.md",
          "role": "skill"
        },
        {
          "path": "skills/tofu-module-gate/scripts/gate.sh",
          "target": ".agents/skills/tofu-module-gate/scripts/gate.sh",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/scripts/gate.sh",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/main.tf",
          "target": ".agents/skills/tofu-module-gate/references/main.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/main.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/variables.tf",
          "target": ".agents/skills/tofu-module-gate/references/variables.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/variables.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/outputs.tf",
          "target": ".agents/skills/tofu-module-gate/references/outputs.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/outputs.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/versions.tf",
          "target": ".agents/skills/tofu-module-gate/references/versions.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/versions.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/bucket.tftest.hcl",
          "target": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/example-root.tf",
          "target": ".agents/skills/tofu-module-gate/references/example-root.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/example-root.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/checkov.yaml",
          "target": ".agents/skills/tofu-module-gate/references/checkov.yaml",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/checkov.yaml",
          "role": "reference"
        }
      ],
      "manual_steps": [],
      "zip_url": "https://loadout.jnw-it.com/download/opentofu-module-checkov/antigravity-cli.zip"
    },
    "copilot": {
      "files": [
        {
          "path": "AGENTS.md",
          "target": "AGENTS.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/AGENTS.md",
          "role": "instructions"
        },
        {
          "path": "skills/tofu-module-gate/SKILL.md",
          "target": ".agents/skills/tofu-module-gate/SKILL.md",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/SKILL.md",
          "role": "skill"
        },
        {
          "path": "skills/tofu-module-gate/scripts/gate.sh",
          "target": ".agents/skills/tofu-module-gate/scripts/gate.sh",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/scripts/gate.sh",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/main.tf",
          "target": ".agents/skills/tofu-module-gate/references/main.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/main.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/variables.tf",
          "target": ".agents/skills/tofu-module-gate/references/variables.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/variables.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/outputs.tf",
          "target": ".agents/skills/tofu-module-gate/references/outputs.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/outputs.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/versions.tf",
          "target": ".agents/skills/tofu-module-gate/references/versions.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/versions.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/bucket.tftest.hcl",
          "target": ".agents/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/bucket.tftest.hcl",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/example-root.tf",
          "target": ".agents/skills/tofu-module-gate/references/example-root.tf",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/example-root.tf",
          "role": "reference"
        },
        {
          "path": "skills/tofu-module-gate/references/checkov.yaml",
          "target": ".agents/skills/tofu-module-gate/references/checkov.yaml",
          "raw_url": "https://loadout.jnw-it.com/raw/opentofu-module-checkov/1.0.0/skills/tofu-module-gate/references/checkov.yaml",
          "role": "reference"
        }
      ],
      "manual_steps": [],
      "zip_url": "https://loadout.jnw-it.com/download/opentofu-module-checkov/copilot.zip"
    }
  },
  "source_zip_url": "https://loadout.jnw-it.com/download/opentofu-module-checkov/source.zip"
}