terraform-provider-docs

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the documentation generator tool from HashiCorp's official GitHub repository (github.com/hashicorp/terraform-plugin-docs). As this is a well-known and trusted organization, the external reference is documented here for transparency.
  • [COMMAND_EXECUTION]: The workflow involves executing go generate ./... and go run commands to process the documentation. These are standard development operations for the intended use case of Terraform provider development.
  • [DYNAMIC_EXECUTION]: The use of go run involves the runtime compilation and execution of the tfplugindocs tool. This is a primary function of the skill's documentation workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data which serves as a potential attack surface for indirect prompt injection.
  • Ingestion points: The agent reads and processes local Markdown templates (e.g., docs/*.md.tmpl) and provider schema definitions to generate the final documentation.
  • Boundary markers: There are no explicit instructions to the agent to disregard embedded directives within the template files or schema descriptions.
  • Capability inventory: The skill possesses the capability to execute shell commands and perform file system operations via the Go toolchain.
  • Sanitization: No specific sanitization or validation steps are outlined for the content of the templates before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 09:24 AM