The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines tools that ingest data from external HCP Terraform APIs (such as get_workspace and list_runs). This represents a potential surface for indirect prompt injection if remote workspace metadata contains malicious instructions. However, there is no implementation code provided to evaluate specific vulnerabilities, and this is a standard risk for tools processing external data.
[CREDENTIALS_UNSAFE]: The skill documentation lists TFE_TOKEN as a prerequisite for operation. This is standard practice for API-based tools and does not involve hardcoded credentials or instructions for unsafe secret handling.

terraform-workspaces