terraform-policy
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [External Reference to Trusted Source]: The skill instructs the agent to fetch provider documentation from the official HashiCorp repository on GitHub. This is used to verify resource attributes and linking keys, ensuring accurate policy generation based on authoritative documentation.
- [Indirect Prompt Injection Considerations]: The skill processes user-provided natural language descriptions and Sentinel code snippets to generate Terraform Policy files (.policy.hcl). While this involves ingesting external data, the skill includes extensive guidance for the agent to use safe HCL idioms—such as mandatory two-step null-safety normalization and explicit operation scoping—to ensure the resulting policies are robust and predictable.
- [Instructional Safety Guidelines]: The references contain multiple safety-critical instructions (labeled with red circles in the source) that steer the agent away from common runtime pitfalls and parser limitations, such as avoiding undefined metadata and implementing proper IAM resource coverage.
Audit Metadata