---
name: review-tf-plan
description: Review a Terraform plan output for red flags before applying. Flags ECS service destruction, deferred data sources, depends_on cascades, and high blast radius changes. Returns PASS/WARN/FAIL verdict. Use this skill whenever the user shares terraform plan output, mentions "terraform apply", asks to review infrastructure changes, pastes HCL plan diffs, or discusses deploy safety for AWS resources — even if they don't explicitly say "review".
---

# /review-tf-plan — Review Terraform Plan

Analyzes Terraform plan output for dangerous changes before applying. Born from PM-18: a `depends_on` cascade destroyed all ECS services during a routine deploy, causing 12 minutes of production downtime.

## Workflow Overview

```
Phase 1: Input     → User provides the plan output
Phase 2: Analysis  → Dispatch tf-plan-reviewer agent
Phase 3: Report    → Present findings and verdict
```

---

## Phase 1: Input

Ask the user to provide the Terraform plan output. Two options:

1. Paste the plan output directly into the chat
2. Provide a file path to a saved plan output

Optionally ask which repo and environment the plan is for (context only, not required for analysis).

If the user pasted partial output, warn that the analysis may be incomplete — the summary line (`Plan: X to add, Y to change, Z to destroy`) is important for accurate assessment.

## Phase 2: Analysis

Dispatch the `tf-plan-reviewer` agent:

1. Read the full content of `agents/tf-plan-reviewer.md` from the plugin directory (`plugins/humand-backend/agents/tf-plan-reviewer.md`).
2. Launch a subagent with `subagent_type="explore"`, model `fast`.
3. Pass the agent prompt (from that file) as instructions and the plan text as the input.
4. The agent does **not** need filesystem access — it only analyzes the provided text.

## Phase 3: Report

Present the agent's findings to the user:

**If verdict is FAIL:**

- Display findings prominently
- State clearly: **"DO NOT APPLY this plan. The following changes would cause downtime or data loss:"**
- List each FAIL finding with the resource address and explanation
- Recommend: investigate the root cause before proceeding

**If verdict is WARN:**

- Display warnings
- State: **"The following items require human review before applying:"**
- List each WARN finding
- Note: warnings don't necessarily mean the plan is wrong, but they deserve attention

**If verdict is PASS:**

- Confirm: **"Plan looks safe to apply. No dangerous changes detected."**
- Show INFO items for context

---

## Important Notes

- This skill analyzes the **text output** of `terraform plan`. It does not run Terraform itself.
- For best results, provide the **complete** plan output including the summary line.
- The red flag catalog is based on real incidents (PM-18) and common Terraform footguns. It may not catch all possible issues — **always review plans yourself as well**.
- False positives are possible (e.g., intentional ECS service replacement during migration). Use judgment.
