fabric-builder
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
scripts/fabric.pyto fetch Terraform module metadata (README, variables, outputs, schemas) directly from the official GoogleCloudPlatform/cloud-foundation-fabric repository on GitHub. These downloads are targeted at a trusted vendor's official source and are necessary for the skill's primary function of providing accurate module documentation. - [COMMAND_EXECUTION]: The
SKILL.mdfile provides instructions for executing thefabric.pyscript to retrieve module details. These commands are localized to the skill's own directory and serve the legitimate purpose of informing the agent about available cloud modules. - [REMOTE_CODE_EXECUTION]: The
fabric.pyscript performs network operations usingurllib.requestto access GitHub APIs and raw content. It includes a--no-ssl-verifyflag to handle potential certificate issues in restrictive environments; while this reduces transport security, it is a documented developer option for the helper utility. - [SAFE]: The Terraform conventions described in
references/conventions.mdexplicitly forbid the use oflocal-execor third-party providers, which is a strong security best practice that reduces the risk of arbitrary command execution during infrastructure deployment.
Audit Metadata