terraform-skill
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains various shell commands for diagnostics and deployment, including
ssh,docker, andpsql. These are provided as standardized patterns for managing Terraform provisioners and verifying service health on remote hosts. - [EXTERNAL_DOWNLOADS]: The skill includes instructions to verify Cloudflare API tokens using Cloudflare's official verification endpoint (
api.cloudflare.com). This is a secure practice for validating credentials using a well-known service. - [INDIRECT_PROMPT_INJECTION]: The skill manages a significant attack surface by ingesting external configuration files (Terraform, Docker Compose, and environment manifests). It mitigates this risk by providing a validation script that uses
jqto enforce strict schema adherence and specifically rejects unresolved placeholders, preventing potential command injection from interpolated configuration data.
Audit Metadata