opentofu-coder

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The file references/post-provisioning.md includes a shell script example that downloads and executes the official Docker installation script using curl -fsSL https://get.docker.com | sh.- [EXTERNAL_DOWNLOADS]: The references/makefile-automation.md file contains a target that uses curl -s ifconfig.me to automatically fetch the current public IP address for infrastructure configuration.- [COMMAND_EXECUTION]: The skill provides various templates for shell scripts, Makefiles, and OpenTofu CLI commands (tofu plan, tofu apply) to automate infrastructure provisioning and remote server setup via SSH.- [INDIRECT_PROMPT_INJECTION]: As an infrastructure-as-code assistant, the skill ingests user requirements to generate configuration files. It mitigates potential injection risks by instructing the agent to implement variable validation, sensitive data marking, and the use of dedicated secret management tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 12:28 AM