terraform-service-scaffold
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the "git-secret-protector" package from PyPI for both local environment setup and CI/CD pipeline execution.\n- [COMMAND_EXECUTION]: The skill generates GitHub Actions workflow files containing shell commands that execute package installations and system-level operations for infrastructure management.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface. User-provided data is interpolated into file templates that later perform shell executions in CI/CD environments.\n
- Ingestion points: User-supplied values for "{service}", "{project}", and "{env}" variables requested in the initial workflow.\n
- Boundary markers: Absent; the skill lacks delimiters or instructions to treat user input as untrusted data during code generation.\n
- Capability inventory: The skill possesses Write and Edit tools, allowing it to create and modify executable script files and configuration.\n
- Sanitization: No validation or sanitization routines are implemented for the user-provided strings before they are embedded in generated files.
Audit Metadata