The Agent Skills Directory

[SAFE]: The skill acts as a passive security auditor for Terraform configuration files. It provides clear comparisons between "Secure" and "Insecure" code patterns to assist the agent in identifying infrastructure vulnerabilities such as broad IAM permissions or unencrypted databases.
[SAFE]: The toolset is restricted to Read, Glob, and Grep. These tools are appropriate for static analysis of local project files and do not provide a path for network-based data exfiltration or system modification.
[SAFE]: The instructions explicitly promote secure practices, such as preventing hardcoded secrets and enforcing least-privilege IAM policies. No patterns relating to prompt injection, obfuscation, or persistence were found.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data (Terraform files). While this introduces a theoretical injection surface if a file contains malicious instructions, the agent lacks the necessary tools (e.g., network access or shell execution) to perform any harmful actions, rendering the risk negligible.

terraform-security-audit