The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the execution of local shell scripts and external command-line tools including terraform, aws, and jq. These tools are used to initialize providers, query resource schemas, and perform cloud infrastructure discovery.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external cloud provider APIs (such as resource names and tags) and uses this information to programmatically generate Terraform HCL files and shell scripts. This creates a potential attack surface if an adversary manages to name a cloud resource with a malicious payload designed to influence the agent or inject code into the generated files.
Ingestion points: Results from terraform query and various AWS CLI commands (e.g., aws dynamodb list-tables, aws rds describe-db-instances) located in SKILL.md and references/MANUAL-IMPORT.md.
Boundary markers: The skill lacks explicit markers or instructions to treat cloud-retrieved data as untrusted or to delimit it within the generated configuration.
Capability inventory: The skill possesses the ability to execute shell commands, write to the local file system (-generate-config-out and shell redirection), and perform network operations via Terraform providers.
Sanitization: Example scripts in references/MANUAL-IMPORT.md perform minimal character replacement (replacing dashes and dots) for resource addresses but do not sanitize attribute values that are written directly into .tf files.- [METADATA_POISONING]: The SKILL.md frontmatter and the header of scripts/list_resources.sh include copyright claims by 'IBM Corp. 2026'. This is deceptive as it contradicts the provided author context ('marcioaltoe') and refers to a future date, which may mislead users or automated systems regarding the skill's origin and validity.

terraform-search-import