terraform

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The provided scripts/tfops Python script executes Terraform or OpenTofu binaries using subprocess.run. This execution is strictly controlled, targeting a specific set of subcommands (validate, plan, apply, import, version) and implementing a mutation gate that requires an explicit --yes flag for infrastructure changes.
  • [DATA_EXFILTRATION]: The skill's operating contract in SKILL.md includes hard boundaries and instructions to ensure the AI agent does not expose raw state files, backend credentials, or provider secrets within the chat context. The tfops script is designed to provide bounded summaries of state data rather than dumping entire sensitive files.
  • [REMOTE_CODE_EXECUTION]: No patterns of downloading and executing remote scripts (e.g., piped curl-to-bash) were detected. The skill relies on locally installed infrastructure tools and explicitly defines requirements for the Terraform/OpenTofu CLI.
  • [SAFE]: All external references and documentation sources point to official repositories and websites for HashiCorp Terraform, OpenTofu (Linux Foundation), and well-known services like endoflife.date. No obfuscation or malicious persistence mechanisms were identified.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 09:20 PM
Security Audit — agent-trust-hub — terraform