terraform
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and manage Terraform infrastructure-as-code files (.tf), which may contain instructions from untrusted external sources such as pull requests.
- Ingestion points: Terraform configuration files, module definitions, and state files ingested from the local file system or remote backends during infrastructure management tasks.
- Boundary markers: The skill provides a "Validation Checklist" in
SKILL.mdand security guidance inreferences/security.mdto ensure configurations are reviewed before application. - Capability inventory: The skill uses the
terraformCLI for core infrastructure operations and standard Proxmox commands (pveum) for environment setup. - Sanitization: The documentation advises marking sensitive variables as
sensitive = trueand utilizing secure secret storage solutions like HashiCorp Vault, 1Password, or environment variables. - [EXTERNAL_DOWNLOADS]: The skill documents and utilizes standard providers and tools from the Terraform ecosystem.
- Evidence: The skill references the
telmate/proxmoxprovider from the Terraform Registry and provides links to established community tools such asTFLint,Checkov, andTerragruntinreferences/external-resources.mdfor linting, security scanning, and cost estimation.
Audit Metadata