terraform-deploy-pitfalls
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous patterns for executing shell commands via Terraform
local-execandremote-execprovisioners, as well asdocker execandpsqlcommands for infrastructure management tasks like database migrations and container health checks. - [EXTERNAL_DOWNLOADS]: Includes instructions for interacting with well-known external services, such as the Cloudflare API for token management and Google Public DNS for domain resolution checks.
- [REMOTE_CODE_EXECUTION]: The skill describes the use of Terraform
remote-execprovisioners to run scripts on remote hosts, which is a standard capability of the infrastructure-as-code tools it documents. - [INDIRECT_PROMPT_INJECTION]: The skill templates interpolate environment variables and user-defined domains into configuration files (Caddyfiles, Docker Compose) and database queries. While this creates a potential surface for injection if variables are sourced from untrusted external data, it is a standard part of the templating process for these technologies.
Audit Metadata