terramate-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of documentation and configuration examples for Terramate, an infrastructure orchestration tool. No malicious patterns or security vulnerabilities were detected in the instructions or scripts.
- [EXTERNAL_DOWNLOADS]: The skill references the official
terramate-io/setup-terramateGitHub Action for CI/CD workflows. This originates from a trusted organization and is a standard integration for the tool. - [COMMAND_EXECUTION]: Instructions involve running standard CLI commands such as
terramate runandterraform plan. These are the intended primary functions of the skill and do not include suspicious or unauthorized command patterns. - [CREDENTIALS_UNSAFE]: Examples involving authentication (e.g.,
TERRAMATE_CLOUD_TOKEN) use generic placeholders likeyour-token, following secure documentation practices. - [DYNAMIC_EXECUTION]: The skill demonstrates the use of Terramate's code generation blocks (
generate_hcl,generate_file) to create configuration files from templates. These operations are performed within the local stack context and use established Terramate functions. - [INDIRECT_PROMPT_INJECTION]: The skill provides a knowledge base for infrastructure management. Ingestion points: SKILL.md and rule files. Boundary markers: HCL and Markdown delimiters. Capability inventory: Orchestration of terraform commands and local file generation. Sanitization: N/A for static content.
Audit Metadata