terraform-stacks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow described in references/api-monitoring.md fetches deployment diagnostics and artifacts from the HCP Terraform API (e.g., GET /api/v2/stack-deployment-steps/{step-id}/stack-diagnostics and /artifacts?name=apply-description), and those responses can include free-form text fields like attributes.diags[].attributes.detail/summary and snippet/code that are not authored by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs include explicit runtime module sources that Terraform will fetch and execute (remote code) such as git::https://github.com/org/repo.git//path?ref=v1.0.0, git::ssh://git@github.com/org/repo.git//modules/vpc?ref=main and https://example.com/modules/vpc-module.tar.gz, so these external URLs are runtime dependencies that result in executing remote Terraform code.