fabric-builder

Pass

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses scripts/fabric.py to fetch Terraform module metadata (README, variables, outputs, schemas) directly from the official GoogleCloudPlatform/cloud-foundation-fabric repository on GitHub. These downloads are targeted at a trusted vendor's official source and are necessary for the skill's primary function of providing accurate module documentation.
  • [COMMAND_EXECUTION]: The SKILL.md file provides instructions for executing the fabric.py script to retrieve module details. These commands are localized to the skill's own directory and serve the legitimate purpose of informing the agent about available cloud modules.
  • [REMOTE_CODE_EXECUTION]: The fabric.py script performs network operations using urllib.request to access GitHub APIs and raw content. It includes a --no-ssl-verify flag to handle potential certificate issues in restrictive environments; while this reduces transport security, it is a documented developer option for the helper utility.
  • [SAFE]: The Terraform conventions described in references/conventions.md explicitly forbid the use of local-exec or third-party providers, which is a strong security best practice that reduces the risk of arbitrary command execution during infrastructure deployment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 6, 2026, 02:22 PM
Security Audit — agent-trust-hub — fabric-builder