The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's scripts (extract_tf_info_wrapper.sh and install_checkov.sh) automatically download and install Python packages (python-hcl2 and checkov) from the public PyPI registry using pip without pinning to specific versions or hashes.
[COMMAND_EXECUTION]: The skill requires the execution of multiple shell commands and scripts (e.g., terraform, tflint, checkov, extract_tf_info_wrapper.sh) to perform its primary function of infrastructure validation.
[PERSISTENCE]: The installation process creates a persistent execution wrapper at ~/.local/bin/checkov, which modifies the environment by adding a new binary to the user's path.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes HCL files (Terraform configuration) from potentially untrusted sources, providing a surface for indirect prompt injection.
Ingestion points: Terraform configuration files (.tf, .tfvars) processed via scripts/extract_tf_info_wrapper.sh and scripts/run_checkov.sh.
Boundary markers: Absent; there are no specific delimiters or "ignore" instructions for the HCL content being processed.
Capability inventory: Subprocess calls to terraform, checkov, and tflint across multiple scripts; file writing for reports and testing.
Sanitization: Partial; the HCL parser extract_tf_info.py uses python-hcl2 to convert input to structured JSON, and run_checkov.sh validates output format flags.

terraform-validator