The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The cloud-init configuration for the center server (assets/terraform-up-tidb-aws/files/cloudinit_center.sh) downloads and executes shell scripts directly from remote servers using the curl | sh pattern. This occurs for both the TiUP installer and the go-tpc tool.
[DATA_EXFILTRATION]: The IAM policy defined in assets/terraform-up-tidb-aws/resource_iam.tf grants broad s3:* permissions on all resources (*). This violates the principle of least privilege and creates a high risk of data exfiltration or manipulation if any EC2 instance in the cluster is compromised.
[CREDENTIALS_UNSAFE]: The network configuration in assets/terraform-up-tidb-aws/resource_vpc.tf creates security groups that allow inbound traffic from any IP address (0.0.0.0/0) on sensitive management ports, including SSH (22), ETCD/Dashboard (2379), and Grafana (3000). While documented in the safety section, this defaults the infrastructure to an insecure state.
[EXTERNAL_DOWNLOADS]: The skill fetches installation scripts from tiup-mirrors.pingcap.com and raw.githubusercontent.com/pingcap/go-tpc. While PingCAP is the official vendor for TiDB, fetching unversioned scripts from remote mirrors for execution remains a supply chain risk.
[COMMAND_EXECUTION]: The scripts/scaffold_project.py script and the agent instructions in references/deployment.md involve extensive local shell execution of Python, Terraform, and AWS CLI commands to manage infrastructure lifecycle.

deploy-tidb-aws