terraform-aws-annotated-blueprint
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates Terraform operations such as
terraform initandterraform providers schemausing shell commands. It also utilizesjqfor data processing andcurlto fetch provider versions. A local bash script,lib/validate_template.sh, is executed to perform automated linting and validation of the generated templates. - [EXTERNAL_DOWNLOADS]: The skill workflow involves downloading provider information from the official HashiCorp Terraform Registry (
registry.terraform.io) and accessing documentation/MCP server configurations via official AWS domains (api.aws). These sources are recognized as well-known and trusted technology services. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied infrastructure descriptions to generate Terraform code, creating a surface for potential injection attacks. 1. Ingestion points: The
{概要}parameter within the/terraform-aws-annotated-blueprintcommand. 2. Boundary markers: Absent; there are no instructions provided to the agent to treat user input as untrusted or to use specific delimiters. 3. Capability inventory: The skill can write files to the local.localdirectory and execute multiple shell-based commands (terraform,jq,curl,bash). 4. Sanitization: The skill does not define any input validation or sanitization routines for the user-provided summary.
Audit Metadata