The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and review external Terraform HCL code and module sources provided by users. Ingesting untrusted data while maintaining capabilities to execute CLI tools and write reports creates a surface for indirect prompt injection.
Ingestion points: The skill reads and evaluates user-provided Terraform configuration files (.tf, .tfvars) and external module sources referenced in the infrastructure code.
Boundary markers: There are no explicit boundary markers or isolation techniques defined to separate untrusted HCL content from the agent's core instructions during the analysis phase.
Capability inventory: The skill utilizes agent capabilities to run terraform, checkov, tflint, and conftest CLI tools, and writes audit deliverables to the docs/local/audits/ directory.
Sanitization: The skill includes instructions to mandate human review of plan outputs and verification of HCL against security checklists, providing a layer of operational oversight.
[COMMAND_EXECUTION]: The skill workflow explicitly instructs the agent to execute several powerful infrastructure-related CLI utilities, including terraform, tofu, checkov, tflint, and conftest. It uses shell redirection and piping (e.g., terraform state pull > backup.tfstate and terraform show -json | conftest test -) for state management and policy validation. While these are necessary for the skill's stated purpose, they involve significant interaction with the execution environment and local file system.

terraform