opentofu-coder
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The file
references/post-provisioning.mdincludes a shell script example that downloads and executes the official Docker installation script usingcurl -fsSL https://get.docker.com | sh.- [EXTERNAL_DOWNLOADS]: Thereferences/makefile-automation.mdfile contains a target that usescurl -s ifconfig.meto automatically fetch the current public IP address for infrastructure configuration.- [COMMAND_EXECUTION]: The skill provides various templates for shell scripts, Makefiles, and OpenTofu CLI commands (tofu plan,tofu apply) to automate infrastructure provisioning and remote server setup via SSH.- [INDIRECT_PROMPT_INJECTION]: As an infrastructure-as-code assistant, the skill ingests user requirements to generate configuration files. It mitigates potential injection risks by instructing the agent to implement variable validation, sensitive data marking, and the use of dedicated secret management tools.
Audit Metadata