The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs users and agents to documentation hosted on jeffallan.github.io, a domain that has been explicitly flagged as malicious by automated reputation scanners.
Evidence: Metadata author link and documentation link in SKILL.md point to https://jeffallan.github.io/claude-skills/skills/infrastructure/terraform-engineer/.
[COMMAND_EXECUTION]: The skill involves the execution of high-privilege commands including terraform apply, terraform init, and terraform import. These tools can modify cloud environments and execute arbitrary local code through Terraform provisioners.
Evidence: Core Workflow and Error Recovery sections in SKILL.md encourage the direct use of the Terraform CLI.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection because it analyzes external infrastructure requirements and source code without implementing security boundaries or sanitization.
Ingestion points: Reviewing infrastructure requirements and existing code in SKILL.md.
Boundary markers: None. There are no instructions to differentiate between trusted and untrusted input during analysis.
Capability inventory: The agent has access to terraform, tflint, and Go-based testing frameworks (terratest), which can perform network and filesystem operations.
Sanitization: None. The skill relies on standard syntax validation which does not detect malicious logic embedded in HCL configurations.

terraform-engineer