The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands to interact with the Terraform lifecycle. Evidence includes usage of terraform state list, terraform show -json, terraform state pull, and terraform state mv in the 'State Migration' and 'Analysis Phase' sections. It also uses jq to parse JSON output from Terraform.
[EXTERNAL_DOWNLOADS]: The skill references external documentation and skill definitions from the official HashiCorp GitHub repository. Evidence includes URLs in the 'Related Skills' section: https://raw.githubusercontent.com/hashicorp/agent-skills/refs/heads/main/plugins/terraform/skills/terraform-style-guide/SKILL.md and https://raw.githubusercontent.com/hashicorp/agent-skills/refs/heads/main/plugins/terraform/skills/azure-verified-modules/SKILL.md. These are handled as references to a trusted organization's infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests and processes external Terraform configuration files.
Ingestion points: Files located in the user-provided source_directory and data retrieved via terraform state pull.
Boundary markers: The instructions do not specify explicit boundary markers for the ingested code, though they rely on the structure of the HCL language itself.
Capability inventory: The skill has the capability to execute shell commands (subprocess calls), write new Terraform files, and perform network operations via Terraform providers.
Sanitization: The skill promotes the use of HCL validation blocks in variables to sanitize inputs (e.g., CIDR block validation).
[DATA_EXPOSURE]: The skill handles Terraform state files which may contain sensitive information. The skill includes an explicit security warning to the agent: "Note: state contains sensitive values in plaintext in every format — never echo state contents into logs or output."

refactor-module