terraform-boas-praticas
Fail
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The 'Regra 4' section in
SKILL.mdprovides shell command templates for checking provider and Terraform versions. These templates include placeholders (<NAMESPACE>,<NOME>) intended for user-provided values. If an agent executes these commands without strict sanitization, an attacker could use malicious provider names to perform command injection. - [REMOTE_CODE_EXECUTION]: The skill fetches version data from a well-known service and pipes the output to a Python interpreter for parsing. While the target domain is an established service, the method of piping network data to a local interpreter is a high-risk execution pattern that should be handled with caution.
Recommendations
- HIGH: Downloads and executes remote code from: https://api.releases.hashicorp.com/v1/releases/terraform/latest, https://registry.terraform.io/v1/providers/ - DO NOT USE without thorough review
Audit Metadata