skills/cosmix/loom/loom-terraform/Gen Agent Trust Hub

loom-terraform

Pass

Audited by Gen Agent Trust Hub on Jul 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous standard shell commands for managing cloud infrastructure and Terraform state, including aws s3api, aws dynamodb, and various tofu (OpenTofu) operations. These are routine administrative tasks within the scope of infrastructure management.
  • [EXTERNAL_DOWNLOADS]: The skill references standard external sources for infrastructure modules, such as the Terraform Registry (terraform-aws-modules/vpc/aws) and organization-specific GitHub repositories. It also mentions industry-standard static analysis tools like tfsec and infracost. These are standard practices in modern DevOps environments.
  • [DATA_EXFILTRATION]: The skill includes instructions for handling Terraform state files, which inherently contain infrastructure metadata. It correctly promotes the use of encrypted remote backends (e.g., AWS S3 with KMS) and state locking to prevent unauthorized access and data corruption, following industry best practices.
  • [CREDENTIALS_UNSAFE]: No hardcoded credentials were detected. The skill proactively guides users to use secure secrets management services like AWS Secrets Manager and to mark sensitive data using Terraform's sensitive attribute to prevent accidental exposure in logs or terminal output.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 25, 2026, 07:35 AM
Security Audit — agent-trust-hub — loom-terraform