{"categories":[{"label":"Build Tools","url":"https://skillfed.io/packages/category/software-development-build-tools"},{"label":"Security","url":"https://skillfed.io/packages/category/security"}],"enrichment":{"capability":"Checkov is a static code analysis tool that scans infrastructure-as-code files (Terraform, CloudFormation, Kubernetes, Dockerfile, and others) and container images to detect security misconfigurations and software vulnerabilities.","skillfed_tags":["security-scanning","infrastructure-as-code","compliance-automation"],"use_cases":["Scan Terraform configurations in CI/CD to block deployments with security misconfigurations before they reach cloud infrastructure.","Validate Kubernetes manifests and Helm charts for compliance with security policies (e.g., pod security standards, RBAC rules).","Detect hardcoded AWS credentials and secrets in infrastructure code and Lambda environment variables.","Perform SCA scanning of container images and open-source dependencies to identify known CVEs.","Generate compliance reports (SARIF, JUnit XML, CycloneDX) for security audits and regulatory requirements.","Enforce organization-specific policies using custom YAML or Python policy definitions across all IaC files."],"what_it_does":"Checkov is a static analysis and software composition analysis (SCA) tool designed to catch security and compliance misconfigurations in infrastructure-as-code before deployment. It scans Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, and several other IaC formats using graph-based analysis to understand context and relationships between resources. The tool also performs SCA scanning to detect known vulnerabilities (CVEs) in container images and open-source packages.\n\nYou run it as a command-line tool pointing to a directory or file, and it reports failures and passes against built-in policies covering AWS, Azure, and Google Cloud security best practices. Results can be output in multiple formats (CLI, JSON, JUnit XML, SARIF, CycloneDX) for integration into CI/CD pipelines or security dashboards. It supports policy suppression, variable evaluation, and secret detection using regex and entropy analysis.","worth_installing":"Yes. Checkov is actively maintained, widely adopted (top 5000 PyPI packages), has no known vulnerabilities, and low install friction. It is essential for teams managing infrastructure-as-code who want to catch security and compliance issues early. The permissive Apache 2.0 license and broad IaC format support make it suitable for most environments. Install it if you use Terraform, CloudFormation, Kubernetes, or Dockerfile in your infrastructure pipeline."},"id":"checkov","links":{"html":"https://skillfed.io/packages/checkov","md":"https://skillfed.io/packages/checkov.md","pypi":"https://pypi.org/project/checkov/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-08-13","license_spdx":null,"license_treatment":"permissive","name":"checkov","python_support":"supports_current","summary":"Infrastructure as code static analysis"},"popularity":{"monthly_downloads":21179540,"position":1008,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"3.3.11"}