Public exposure
buckets/blobs public, security groups `0.0.0.0/0` on admin ports (22, 3389, DB ports), public DB instances, LoadBalancer services with no auth.
The pack · 04 / 14 →
Cloud
Husky
the cloud dog. Misconfigurations in Terraform, Kubernetes, Dockerfiles and CI pipelines.
storage.tf
12resource "aws_s3_bucket" "uploads" {
13 bucket = "acme-user-uploads"
14 acl = "public-read" acl = "private"
15 tags = { team = "core" }
16}
Public S3 bucket
ExploitAnyone can list and download user files
FixSmallest change suggested
Husky is watching$ /watchdog-go-cloud0 found · 0 fixed
What it does
On duty while you build.
A misconfiguration lens for infrastructure-as-code that stays on all session, plus an on-demand audit.
The always-on lens flags public exposure, wildcard IAM, secrets in config, privileged containers, missing encryption/logging and CI supply-chain risks as you work.
What it checks
6 things Husky looks for.
IAM
`Action: "*"` / `Resource: "*"`, `iam:PassRole` broad, assumable roles with `Principal: "*"`, long-lived access keys, cluster-admin bindings for workloads.
Secrets
credentials in tfvars, manifests, Dockerfile `ENV`/`ARG`, CI env, state files committed. Never print a secret's value — not keys, tokens, passwords (even weak or default ones), or connection strings. Name the file:line and the kind of secret only, e.g. `password default (redacted)`. Writing a value and labelling it redacted is a leak.
Workload hardening
`privileged: true`, `hostNetwork`/`hostPID`, `hostPath` mounts, running as root, no resource limits, `allowPrivilegeEscalation`, `:latest` images.
Encryption & logging
storage/DB/volumes unencrypted, TLS off, audit/flow logs disabled, no versioning on state buckets.
CI/CD supply chain
`pull_request_target` checking out PR code, unpinned third-party actions, `permissions: write-all`, secrets exposed to forks, `curl | sh`.
Commands
Send Husky out.
Runs these scanners when installed, then reads the code they can't understand:
- checkov
- tfsec
- kube-score
- hadolint
- actionlint
- gitleaks
Static audit of Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipelines
- /watchdog-go-infra
- /watchdog-go-all
Also runs in these bundles.
Benchmark
Tested, not promised.
Its test target holds an insecure Terraform + Kubernetes + Dockerfile + GitHub Actions setup (17 planted misconfigs, 3 decoys) and an answer key. First run of /watchdog-go-cloud (2026-10-27, one run per model, skill text given to a subagent):
found
Haiku 5.517/17
Sonnet 5.517/17
Opus 5.517/17
Rules of engagement
What Husky will never do.
- 1
Static review only. Never run `terraform apply`, `kubectl apply`, or any state-changing cloud call.
- 2
Root cause over symptom: follow modules, variables and defaults before calling something safe.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Husky, answered.
What does Husky check for?
Husky is Watchdog's cloud dog for Claude Code. It looks for Public exposure, IAM, Secrets, Workload hardening, Encryption & logging and CI/CD supply chain. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Husky in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-cloud. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Husky use?
When they're installed, Husky runs checkov, tfsec, kube-score, hadolint, actionlint and gitleaks, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Husky safe to run on my project?
Yes. Its first rule: Static review only. Never run terraform apply, kubectl apply, or any state-changing cloud call. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).