security-platform-iac-cloud
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust security model through its
sensitive_data_rules, which explicitly prohibit the agent from accessing sensitive local files such as.env,secrets/**,*.tfstate,kubeconfig, and private keys (*.pem,*.key). - [SAFE]: High-risk operations classified under 'Tier B'—including Kubernetes runtime benchmarks and cloud posture assessments—are protected by a mandatory manual user authorization gate. The skill does not execute these commands autonomously.
- [SAFE]: The configuration utilizes the
forbidden-toolsfield to blockWebFetch, significantly reducing the risk of unauthorized data exfiltration via HTTP requests. - [SAFE]: The skill workflow incorporates automated data sanitization, requiring the redaction of account IDs, tokens, and internal IPs before any data is presented to the model context, and mandates the use of
--redactflags for secret scanning tools like Gitleaks. - [SAFE]: All external tools referenced (e.g., Trivy, Checkov, Prowler, Kyverno) are well-known, industry-standard security utilities from established vendors and organizations.
Audit Metadata