The Agent Skills Directory

[SAFE]: The skill demonstrates security awareness by instructing the user to create Secret Manager containers without versions to avoid leaking sensitive data into Terraform state files.
[COMMAND_EXECUTION]: The skill generates a shell script (bootstrap-state.sh) to automate the creation and hardening of Google Cloud Storage buckets for Terraform backends. The script uses standard gcloud commands and includes safety flags like set -euo pipefail and --public-access-prevention.
[SAFE]: Terraform provider configurations use the official hashicorp/google source with version constraints, which is a standard and secure practice.
[INDIRECT_PROMPT_INJECTION]: The skill reads local project metadata such as package.json and existing Terraform files to maintain consistency. While this represents a surface for indirect prompt injection if the processed codebase were malicious, it is restricted to the user's own local environment and serves a legitimate functional purpose.
[SAFE]: Verification steps use local terraform commands (fmt, init, validate) to ensure configuration integrity before deployment.

gcp-terraform