oma-tf-infra
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill incorporates robust security controls, including rules against hardcoded secrets, mandatory use of least privilege IAM policies, and OIDC/workload identity for CI/CD authentication.
- [EXTERNAL_DOWNLOADS]: The skill references standard DevOps tools and libraries in its examples, such as Terratest (github.com/gruntwork-io/terratest) and official GitHub Actions (e.g., actions/checkout, hashicorp/setup-terraform). These resources originate from established infrastructure and automation providers.
- [COMMAND_EXECUTION]: The skill guides the agent to execute standard Terraform CLI commands (terraform init, validate, fmt, plan, apply) and security scanners (checkov, tflint, opa). These operations are consistent with the skill's primary purpose of infrastructure management and auditing.
- [INDIRECT_PROMPT_INJECTION]: The skill processes infrastructure requirements provided by users to generate HCL code (ingestion points: user prompts; capability: terraform apply). This surface is managed by instructions requiring formatting and validation (boundary markers: terraform validate) of all generated content before it is applied to production environments.
Audit Metadata