fabric-builder
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves module metadata, README files, and Terraform variable definitions from the official Google Cloud Foundation Fabric repository on GitHub via a local Python helper script.
- [COMMAND_EXECUTION]: Utilizes a local Python script (
scripts/fabric.py) to automate data retrieval from the GitHub API and recommends using standardterraformCLI tools (fmt,validate,plan) to check generated code. - [PROMPT_INJECTION]: The skill processes external data fetched from GitHub, which presents a surface for indirect prompt injection.
- Ingestion points: Module READMEs and variable files are fetched by
scripts/fabric.pyfrom the remote repository. - Boundary markers: The script wraps fetched content in
<BEGIN>and<END>delimiters to distinguish it from the agent's instructions. - Capability inventory: The skill has the ability to execute the
fabric.pyscript and standardterraformcommands. - Sanitization: The script performs basic sanitization by stripping standard license and copyright headers using regular expressions before presenting the data to the agent.
Audit Metadata