provider-configuration
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- Credential Management Best Practices: The skill correctly instructs developers to use
Sensitive: truefor API keys and secrets in Terraform schemas, ensuring they are redacted from CLI output and state files. It also enforces a 'resolve as a set' rule to prevent partial credential exposure. - Secret Hygiene: The implementation includes custom
String()andGoString()methods for credential types that explicitly redact secrets to prevent accidental leaks in logs or diagnostic messages. - Safe Local File Access: The credential chain implementation includes logic to read from
~/.examplecloud/credentials. It incorporates a security check (PermissionsTooOpen) to warn users if their local credentials file has insecure permissions (e.g., group/world readable). - Environment Variable Fallbacks: The pattern uses standard environment variable resolution (
os.Getenv) which is the expected and safe behavior for infrastructure tooling. - Diagnostic Security: The instructions emphasize logging the source of credentials (e.g., 'environment variables') rather than the values themselves, which is a key practice for secure observability.
Audit Metadata