# Tenable IaC Finding to PR

> A Claude Code skill that turns open Tenable Cloud Security IaC findings into reviewed, mergeable GitHub fix PRs

- Type: Skill
- Author: tomabai
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-08-26
- Source repository: https://github.com/tomabai/tenable-iac-finding-to-pr
- Repo state: not archived
- Last push: 2026-08-26T08:59:17Z
- Stars: 2 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Shell
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: cloud-security, application-security
- Tags: claude-code, tenable-cloud-security, iac, terraform, remediation, pull-request
- Date added: 2026-08-05
- Compatible platforms: Claude Code
- Invocation: `/tenable-iac-finding-to-pr`
- Listing page: https://exchange.tenable.com/skills/tenable-iac-finding-to-pr
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tenable-iac-finding-to-pr.md

A Claude Code skill that turns open Infrastructure-as-Code (IaC) security findings from Tenable Cloud Security (TCS) into reviewed, mergeable GitHub pull requests. The platform provides the intent of a fix — the policy name and description — and the skill authors the minimal Terraform change itself, then opens a PR whose body links every fix back to the finding in the Tenable console.

## What it does

- Verifies the Tenable Cloud Security MCP server is connected before doing anything, and prints install steps if it isn't
- Fetches open IaC findings for a repository via the TCS MCP (filtered to Open only), asking which repo when you don't name one or letting you sweep all repos with findings
- Surfaces the findings in a compact table — severity, policy, resource/file, and a link back to the platform — so you see exactly what will change before any code is touched
- Authors minimal Terraform fixes targeting the exact named resource, never renaming or removing resources and never fabricating values
- Opens one combined PR or one PR per finding, each with a findings table and per-finding Risk / Remediation Applied sections grounded in the policy

## How it works

The skill is interactive by design and never opens a PR before you've seen the findings and chosen how to split them. It confirms the `TCS` MCP tools are reachable, runs a GraphQL query for `CodeFinding` records, presents them for review, reads each affected file to match the resource by exact name, applies the minimal change the policy requires, then creates the branch, commits, pushes, and opens the pull request — handling common `gh`/`git` gotchas such as account flips and stale credential helpers along the way.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tenable-iac-finding-to-pr.json. The full index and how to read it: https://exchange.tenable.com/llms.txt