iac-terraform
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation in
references/cost_optimization.mdprovides instructions for installing the Infracost utility by fetching and executing a shell script from its official repository usingcurl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | sh. - [INDIRECT_PROMPT_INJECTION]: The skill processes HCL and configuration files, which constitutes an indirect injection attack surface.
- Ingestion points: The skill is designed to interact with and process
.tf,.hcl, and.tfvarsfiles provided within the user's workspace. - Boundary markers: No specific boundary markers or instructions to ignore embedded strings or comments in the IaC files are provided.
- Capability inventory: The skill triggers the execution of system-level commands including
terraform,terragrunt, and local Python utilities (scripts/init_module.pyandscripts/validate_module.py) that perform file read/write operations. - Sanitization: The provided scripts and workflows do not perform sanitization of the content found within the HCL files they process.
- [COMMAND_EXECUTION]: The skill relies on the execution of various CLI tools and Python scripts to perform infrastructure management tasks, which is standard for this skill's intended purpose.
Audit Metadata