infra-as-code-review
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill analyzes user-supplied Infrastructure-as-Code (IaC) to generate review reports, which introduces a surface for indirect prompt injection. If a user pastes code containing instructions for the agent, the agent might inadvertently follow them. However, the skill's scope is limited to text generation, and it lacks dangerous capabilities like network access or shell execution.
- Ingestion points: IaC code provided by the user via the input section in SKILL.md.
- Boundary markers: The template does not utilize specific delimiters to isolate user-provided code from the agent's instructions.
- Capability inventory: The skill only generates a markdown-formatted review report; it does not perform any file system, network, or subprocess operations.
- Sanitization: No input validation or instruction-filtering is applied to the provided IaC code.
Audit Metadata