terraform-infrastructure-as-code
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The README.md file contains instructions to download the official GPG signing key from HashiCorp's releases server (apt.releases.hashicorp.com) to verify and install Terraform packages on Linux systems.
- [COMMAND_EXECUTION]: The skill provides numerous examples and documentation for Terraform provisioners such as local-exec and remote-exec. These are core features of the tool used to execute shell commands for server configuration, software deployment, and lifecycle management.
- [PRIVILEGE_ESCALATION]: Installation guides and configuration scripts in the skill's examples utilize sudo for administrative operations, including managing system packages, configuring systemd services, and moving files into protected system directories.
- [DATA_EXFILTRATION]: Example 12 in EXAMPLES.md demonstrates a pattern for using local-exec to send deployment status data to an external Slack webhook (hooks.slack.com), which represents an intentional network communication channel.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a significant surface area for ingesting user-supplied configuration data and variables. This information is interpolated into HCL code and shell scripts that are subsequently executed by the agent, though this is expected behavior for infrastructure automation.
Audit Metadata