The Agent Skills Directory

[COMMAND_EXECUTION]: The tfops script executes infrastructure binaries such as terraform and tofu via subprocess.run. The binary path is configurable through the TERRAFORM environment variable, which is standard for developer tools but presents an execution risk if environment variables are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data from Terraform state and plan files. 1. Ingestion points: Data is read by scripts/tfops in the analyze_state, inspect_state, and inspect_plan_guard functions. 2. Boundary markers: The script does not wrap ingested data in explicit delimiters or instructions to ignore embedded commands. 3. Capability inventory: The skill can trigger shell commands with network access through the delegated binary and perform disk operations. 4. Sanitization: While the skill validates JSON structure, it does not sanitize the contents of resource attributes for adversarial strings.
[DYNAMIC_EXECUTION]: The test suite in tests/test_tfops.py uses a FakeTerraformBinary class to write shell scripts to temporary files and grant them execution permissions. This allows for the runtime creation and execution of executable content during unit testing.
[EXTERNAL_DOWNLOADS]: The skill references official software releases from the GitHub repositories of HashiCorp and OpenTofu. These references target established technology organizations for the purpose of providing version information and official documentation.

terraform