terraform-generator

SUSPICIOUS: the skill is largely aligned with its Terraform-generation purpose and shows no direct exfiltration or malicious payloads, but it requires a transitive companion skill and consumes untrusted web content that can affect generated output. Overall this is a coherent developer workflow skill with medium risk from trust expansion, not confirmed malware.

No evidence of intentional malware, data exfiltration, backdoors, cryptomining, or sabotage is present in the supplied Terraform. The primary risks are infrastructure security misconfigurations: broad public network exposure, potentially unauthenticated HTTP function invocation, excessive GCP permissions, and secrets being present in Terraform inputs and likely state. Review the omitted startup scripts, function archives, provider credentials, Terraform backend, and referenced modules before deployment.