iac-planner
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Employs the
Bashtool to executeterraform planon HCL code that is dynamically generated according to user requirements. - [EXTERNAL_DOWNLOADS]: Terraform operations routinely download provider plugins and modules from the HashiCorp Terraform Registry to satisfy configuration requirements.
- [PROMPT_INJECTION]: The skill processes untrusted user input to generate infrastructure-as-code, creating a surface for indirect prompt injection.
- Ingestion points: User-provided parameters for infrastructure provisioning (e.g., Cloud provider, instance size, regions) as described in
SKILL.mdinstructions. - Boundary markers: Absent. The skill does not define clear delimiters or "ignore" instructions for external content.
- Capability inventory: Access to
Bash(shell execution),Write(file system modification), andRead(file system access). - Sanitization: Absent. There are no explicit steps to validate or sanitize user input before it is interpolated into the generated Terraform files.
Audit Metadata