tf-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed as a read-only policy gate. It scans Terraform files provided by the user and generates a report on security posture compliance. It does not modify existing code, perform network operations, or interact with sensitive host files.
- [COMMAND_EXECUTION]: The skill's testing suite (
scripts/test_validate_terraform_policy.py) utilizessubprocess.runto verify the policy validator against local fixtures. The command execution is restricted to the local environment and uses hardcoded script paths for verification purposes. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Terraform files as ingestion points. While this creates a theoretical attack surface for indirect prompt injection, the risk is mitigated by the use of a custom HCL lexer (
_lex_hcl) that correctly identifies block structures and strips comments before analysis. The output is a structured JSON report designed for safe agent consumption.
Audit Metadata