The Agent Skills Directory

Command Execution via Local Scripts: The skill utilizes Python scripts (fetch_terraform_template.py, list_terraform_templates.py) to interact with GCP via the gcloud CLI. These scripts use subprocess.run with argument lists rather than shell strings, which is a secure method for executing system commands. This functionality is essential for retrieving templates and listing resources within the GCP environment.\n- External Resource Downloads: The skill is designed to fetch Terraform modules from external Git repositories, such as those within the GoogleCloudPlatform organization on GitHub. The instructions mandate strict version pinning using Git tags (e.g., ?ref=vX.Y.Z) and require these tags to match verified registry metadata, ensuring the integrity and stability of the infrastructure code.\n- Sensitive Data Handling (Secret Management): A mandatory policy is enforced to prevent the inclusion of plaintext secrets in Terraform configuration files. The skill requires all sensitive inputs to be managed through GCP Secret Manager, aligning with enterprise security standards for credential handling.\n- Iterative Validation and Assessment: Before any cloud deployment, the skill performs local Terraform validation (init, validate, plan) and executes a plan assessment report via the gcloud design-center tool. This shift-left approach identifies security and configuration violations early in the design phase.\n- Indirect Prompt Injection Surface: As the skill processes user-provided architectural requirements to generate HCL code, there is an ingestion point for untrusted data in Phase 1. The skill mitigates this risk through multiple boundary markers, including mandatory local validation and automated plan assessments. The capability inventory includes CLI execution and file writing, but the automated sanitization steps performed by the assessment API minimize the potential for unintended execution.

design-deploy