Review a Terraform plan with a blast-radius SKILL.md

Write SKILL.md for reviewing Terraform plan output before apply. The agent assists a human who will run apply — it must not run apply or paste cloud credentials into chat.

Repository context:
[terraform root modules, environments e.g. staging/prod, backend type — S3, GCS, Terraform Cloud]
[how you generate plans: terraform plan -out=plan.tfplan, terraform show -json, or CI artifact path]
[resources that always need human approval: prod databases, DNS, IAM admin, KMS]

Plan context (paste when using the skill):
[terraform show -no-color plan output OR summary from CI, workspace name, target branch]

SKILL.md sections in order:
1. Purpose — catch blast radius and privilege expansion before apply, not after an outage.
2. When to use — any PR or change that runs plan against shared state; when not to use — docs-only, .tfvars examples with no plan run.
3. Hard rules:
   - Never paste secrets, tokens, or full tfvars with real values into chat or commits.
   - Never approve apply when plan shows destroy on [list critical resource types] without named human ack in the ticket.
   - Treat "no-op" plans that follow manual console edits as state drift — flag before apply.
4. Required inputs: plan text or JSON summary, workspace/environment, ticket id, and whether this is first apply or drift correction.
5. Review checklist the agent must complete and paste in the PR/ticket:
   - Count: N to add, N to change, N to destroy, N to replace (note replace forces destroy+create).
   - List every destroy and replace with resource address and one-line reason from the diff.
   - IAM delta: new policies, broader actions (*), new trust relationships, public exposure (0.0.0.0/0, allUsers).
   - Data risk: databases, buckets, queues with force_destroy, lifecycle deletes, snapshot gaps.
   - State/backend: workspace switch, moved blocks, import blocks — confirm intentional.
   - Drift: resources changed outside Terraform — mark reconcile vs adopt vs block.
6. Steps for the agent:
   - Parse plan top to bottom; do not skip "minor" changes on security groups or IAM.
   - Map each risky change to rollback: can we revert the commit and re-plan, or is destroy irreversible?
   - If plan is too large, summarize by module and escalate modules with any destroy/replace.
   - Output verdict: Approve review / Block — needs human / Block — drift unresolved.
7. Two example prompts: routine tag-only change vs replace of load balancer or RDS instance.
8. Pitfalls: approving because "only 2 destroys", missing replace semantics, ignoring data sources that will fail on apply, rubber-stamping CI green without reading plan artifact.
9. Done means: checklist complete, destroy/replace list non-empty or explicitly zero, verdict recorded, no secrets in comment.

Rules:
- Use only resource addresses appearing in the pasted plan; do not invent modules.
- Do not run terraform apply from the agent session.
- Output only SKILL.md markdown.