huawei-cloud-terraform-generator
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The SKILL.md file uses directive markers such as 'CRITICAL', 'MANDATORY', and 'FORBIDDEN' to strictly dictate the agent's behavior and validation workflow during the generation process.
- [PROMPT_INJECTION]: The skill provides an indirect prompt injection surface as it translates user-described infrastructure goals into executable code without defining specific sanitization or boundary markers in the agent instructions.
- [CREDENTIALS_UNSAFE]: Multiple assets include hardcoded example passwords in terraform.tfvars files. Examples include 'Kafkatest@123' in the Kafka forward plugin and 'YourCBHInstancePassword!' in the Cloud Bastion Host instances.
- [COMMAND_EXECUTION]: Terraform configurations utilize 'local-exec' provisioners to run local shell commands. For example, assets/aom/alarm-rule/distribute-alarm/main.tf executes 'sleep 240' and assets/cce/kubenetes/authenticate-with-config/main.tf executes 'rm -rf .kube' upon resource destruction.
- [EXTERNAL_DOWNLOADS]: The skill setup involves configuring a network mirror at https://mirrors.huaweicloud.com/terraform/ to fetch Terraform providers, which is an official resource owned by the vendor.
Audit Metadata