The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Automated reputation scanners have flagged the documentation URL https://jeffallan.github.io/claude-skills/skills/infrastructure/terraform-engineer/ as malicious. The link is presented as project documentation in the skill definition.\n- [METADATA_POISONING]: The skill definition file SKILL.md has been flagged as malicious by reputation scanners (FileRepMalware). This alert indicates that the file identity or content is associated with malicious software or distribution patterns.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted infrastructure requirements and Terraform code from external sources, which presents an attack surface where malicious instructions could be embedded. The skill possesses the capability to execute commands based on these inputs.\n
Ingestion points: User-provided infrastructure requirements and existing Terraform configuration files in the engineering workflow.\n
Boundary markers: A mandatory safety checkpoint is included in the workflow (Step 7) requiring the agent to present a plan summary and receive explicit user approval before applying changes.\n
Capability inventory: Execution of terraform CLI commands and various infrastructure analysis tools (tflint, checkov).\n
Sanitization: There are no mentioned procedures for sanitizing or validating external input before processing or execution.\n- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to execute powerful shell commands, including terraform apply, which can fundamentally alter cloud infrastructure environments. Combined with the other security alerts, this increases the skill's risk profile.\n
Evidence: The core workflow in SKILL.md directs the agent to execute terraform fmt, terraform validate, tflint, terraform plan, and terraform apply.

terraform-engineer