iac-misconfig-scan
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of instructions for the AI to perform a diagnostic review of local configuration files. It does not include any executable scripts or network-active code.
- [EXTERNAL_DOWNLOADS]: References the vendor's website at qualitymax.io for further security services. This is a legitimate vendor resource.
- [PROMPT_INJECTION]: The skill interacts with untrusted external data by scanning user-provided configuration files, which presents an indirect prompt injection surface.
- Ingestion points: Reads IaC files including
Dockerfile,docker-compose.yml,*.tf, and.github/workflows/*.yml. - Boundary markers: The instructions do not provide explicit delimiters to separate untrusted file content from the agent's instructions.
- Capability inventory: The skill is read-only and diagnostic; it does not possess file-writing, shell execution, or network exfiltration capabilities.
- Sanitization: The agent processes the raw content of the target files for analysis without sanitization filters.
Audit Metadata