terraform-provider-docs
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the documentation generator tool from HashiCorp's official GitHub repository (
github.com/hashicorp/terraform-plugin-docs). As this is a well-known and trusted organization, the external reference is documented here for transparency. - [COMMAND_EXECUTION]: The workflow involves executing
go generate ./...andgo runcommands to process the documentation. These are standard development operations for the intended use case of Terraform provider development. - [DYNAMIC_EXECUTION]: The use of
go runinvolves the runtime compilation and execution of thetfplugindocstool. This is a primary function of the skill's documentation workflow. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data which serves as a potential attack surface for indirect prompt injection.
- Ingestion points: The agent reads and processes local Markdown templates (e.g.,
docs/*.md.tmpl) and provider schema definitions to generate the final documentation. - Boundary markers: There are no explicit instructions to the agent to disregard embedded directives within the template files or schema descriptions.
- Capability inventory: The skill possesses the capability to execute shell commands and perform file system operations via the Go toolchain.
- Sanitization: No specific sanitization or validation steps are outlined for the content of the templates before they are processed by the agent.
Audit Metadata