terraform-skill
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Installation steps for development utilities such as
tflintandtrivyin the provided CI/CD and security examples utilize the piped shell execution pattern (curl | bash). - [EXTERNAL_DOWNLOADS]: Fetches installation scripts and binaries from external GitHub repositories for Aqua Security and Terraform Linters to support linting and security scanning.
- [COMMAND_EXECUTION]: Provides shell scripts intended to automate the cleanup of cloud resources, such as EC2 instances, using the AWS CLI in
references/ci-cd-workflows.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes user infrastructure requirements to generate Terraform configurations, creating an attack surface for indirect instructions.
- Ingestion points: User-provided infrastructure descriptions and variable values used during the code generation process.
- Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands in the processed data.
- Capability inventory: The generated configurations can execute shell commands and perform network operations via Terraform providers and CI/CD pipelines.
- Sanitization: Present; the skill provides examples and best practices in
references/module-patterns.mdfor implementing input validation blocks within Terraform configurations to restrict variable values.
Audit Metadata