alibabacloud-terraform-code-generation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md Step 4.1/4.2 requires live IaCService metadata/provider-document lookups via an MCP CallCLI tool (e.g., aliyun iacservice get-resource-type / get-provider-document), whose returned JSON/text is then used to “recite” evidence and drive HCL generation—this is outsider-authored free text from a remote service at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill can fetch provider documentation from the terraform-provider-alicloud GitHub (e.g. fallback to https://github.com/aliyun/terraform-provider-alicloud/blob/master/website/docs/...) at runtime to drive HCL generation and recitation, so remote GitHub content (and the provider repo URL https://github.com/aliyun/terraform-provider-alicloud.git) is used to control prompts/behavior.