rudder-terraform-setup
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
sudofor installing system packages and managing GPG keys on Linux. This constitutes a privilege escalation vector, although it is standard for the installation of Terraform. - [COMMAND_EXECUTION]: The skill instructs the agent to modify the user's shell profile (
~/.zshrcor~/.bashrc) to persist theRUDDERSTACK_ACCESS_TOKEN. Appending commands to shell profiles is a persistence mechanism. - [EXTERNAL_DOWNLOADS]: Fetches GPG keys and repository configuration from HashiCorp's official release infrastructure (
apt.releases.hashicorp.com). - [EXTERNAL_DOWNLOADS]: Downloads the
rudderlabs/rudderstackprovider from the official Terraform Registry during initialization. - [CREDENTIALS_UNSAFE]: Suggests storing a plaintext sensitive access token within shell configuration files, which may lead to credential exposure if these files are accessed by other processes or users.
Audit Metadata