codeguard-terraform
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process Terraform and OpenTofu configuration files (.tf, .tfvars, .tofu) which are external, untrusted data sources analyzed by the agent. If these files contain adversarial instructions disguised as comments, they could influence agent behavior during analysis.
- Ingestion points: The skill targets .tf, .tfvars, and .tofu files within the project workspace as described in SKILL.md (Capability 1 and Workflow Step 1).
- Boundary markers: The instructions lack explicit delimiters or warnings to the agent to ignore natural language instructions embedded within the code or comments of the processed files.
- Capability inventory: The skill executes local shell commands tflint and terraform fmt based on the processed file content (SKILL.md Workflow Steps 4 and 6).
- Sanitization: There is no evidence of content sanitization or filtering before the agent interprets the file contents for reporting.
Audit Metadata