terraform

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and manage Terraform infrastructure-as-code files (.tf), which may contain instructions from untrusted external sources such as pull requests.
  • Ingestion points: Terraform configuration files, module definitions, and state files ingested from the local file system or remote backends during infrastructure management tasks.
  • Boundary markers: The skill provides a "Validation Checklist" in SKILL.md and security guidance in references/security.md to ensure configurations are reviewed before application.
  • Capability inventory: The skill uses the terraform CLI for core infrastructure operations and standard Proxmox commands (pveum) for environment setup.
  • Sanitization: The documentation advises marking sensitive variables as sensitive = true and utilizing secure secret storage solutions like HashiCorp Vault, 1Password, or environment variables.
  • [EXTERNAL_DOWNLOADS]: The skill documents and utilizes standard providers and tools from the Terraform ecosystem.
  • Evidence: The skill references the telmate/proxmox provider from the Terraform Registry and provides links to established community tools such as TFLint, Checkov, and Terragrunt in references/external-resources.md for linting, security scanning, and cost estimation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:37 AM