terraform-patterns

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a third‑party GitHub repository (github.com/ciciliaETH/claude-skills.git) from an individual account rather than an official vendor; cloning and running code from unknown repos can execute unreviewed scripts and install files, so it is potentially risky.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The /terraform:review workflow reads and ingests user-provided Terraform HCL by “read all .tf files in the target directory” and passes their file contents to scripts/tf_module_analyzer.py and scripts/tf_security_scanner.py, which parse/search that text at runtime.