iac-terraform

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation in references/cost_optimization.md provides instructions for installing the Infracost utility by fetching and executing a shell script from its official repository using curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | sh.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes HCL and configuration files, which constitutes an indirect injection attack surface.
  • Ingestion points: The skill is designed to interact with and process .tf, .hcl, and .tfvars files provided within the user's workspace.
  • Boundary markers: No specific boundary markers or instructions to ignore embedded strings or comments in the IaC files are provided.
  • Capability inventory: The skill triggers the execution of system-level commands including terraform, terragrunt, and local Python utilities (scripts/init_module.py and scripts/validate_module.py) that perform file read/write operations.
  • Sanitization: The provided scripts and workflows do not perform sanitization of the content found within the HCL files they process.
  • [COMMAND_EXECUTION]: The skill relies on the execution of various CLI tools and Python scripts to perform infrastructure management tasks, which is standard for this skill's intended purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 03:26 PM