new-terraform-provider
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill uses standard Go toolchain commands including
go get,go mod tidy,go build, andgo testto initialize the project and verify the environment. These commands are typical for Go development and are appropriate for a project scaffolding tool. - External Resource Access: The skill downloads the Terraform plugin framework library from its official public repository. This is an expected dependency for developing providers within this ecosystem and uses standard package management.
- Indirect Prompt Injection Surface: The skill generates code based on user-provided information such as provider names and API configurations. This represents a potential surface where user-supplied data is interpolated into generated files.
- Ingestion points: User-specified provider names and API details (processed in
SKILL.mdsteps 2 and 6). - Boundary markers: Absent.
- Capability inventory: Shell command execution (
go) and file writing (main.go,internal/provider/provider.go) as defined inSKILL.mdsteps 3 through 10. - Sanitization: Absent; user input is used directly to name directories and fill code templates.
Audit Metadata