terraform-engineer
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes user-provided Terraform requirements and existing infrastructure code as part of its core workflow. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the code comments or metadata of files being reviewed by the agent.
- Ingestion points: Reads local Terraform files (
.tf,.tfvars) and requirements documentation. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Executes
terraformoperations (plan, apply, import, state management) across AWS, Azure, and GCP providers. - Sanitization: No validation or sanitization of external HCL content before processing.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a variety of shell commands and specialized CLI tools including
terraform,tflint,opa,conftest, andpre-commitfor the purpose of infrastructure automation and testing. - [EXTERNAL_DOWNLOADS]: Fetches and uses various external dependencies from well-known technology providers and official repositories:
- Downloads Terraform providers from the official HashiCorp registry.
- References Go-based testing frameworks like
terratestandtestifyfrom Gruntwork's GitHub repository. - Utilizes GitHub Actions for CI/CD workflows from HashiCorp, Bridgecrew, and the Terraform Linters organization.
- References official Helm charts for Kubernetes deployments.
Audit Metadata