alibabacloud-terraform-import
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands to manage the IaC environment, including
terraformfor state operations,python3for JSON data processing, and standard filesystem utilities likemkdir. These operations are transparently documented and necessary for the skill's primary function. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the official Alibaba Cloud Terraform provider from the HashiCorp Terraform Registry. It also provides instructions for installing Terraform via Homebrew on macOS, which is a well-known and trusted package management service.
- [DATA_EXFILTRATION]: Network operations are performed via the
alibabacloud-coreMCP tool to communicate with official Alibaba Cloud API endpoints (e.g.,resourcecenter.aliyuncs.com,iacservice.aliyuncs.com). These requests are used solely to discover and retrieve resource metadata required for generating Terraform configurations. - [PROMPT_INJECTION]: A technical review of the instructions confirms there are no attempts to override agent behavior, bypass safety filters, or extract system prompts. The instructions are focused on technical workflows for cloud migration.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from cloud API responses and local Terraform state files. While this constitutes an attack surface, the data is processed structurally as JSON and used to populate HCL templates for resource IDs and attributes. The risk is considered minimal and inherent to the task of resource management.
Audit Metadata