terramate-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill consists of documentation and configuration examples for Terramate, an infrastructure orchestration tool. No malicious patterns or security vulnerabilities were detected in the instructions or scripts.
  • [EXTERNAL_DOWNLOADS]: The skill references the official terramate-io/setup-terramate GitHub Action for CI/CD workflows. This originates from a trusted organization and is a standard integration for the tool.
  • [COMMAND_EXECUTION]: Instructions involve running standard CLI commands such as terramate run and terraform plan. These are the intended primary functions of the skill and do not include suspicious or unauthorized command patterns.
  • [CREDENTIALS_UNSAFE]: Examples involving authentication (e.g., TERRAMATE_CLOUD_TOKEN) use generic placeholders like your-token, following secure documentation practices.
  • [DYNAMIC_EXECUTION]: The skill demonstrates the use of Terramate's code generation blocks (generate_hcl, generate_file) to create configuration files from templates. These operations are performed within the local stack context and use established Terramate functions.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides a knowledge base for infrastructure management. Ingestion points: SKILL.md and rule files. Boundary markers: HCL and Markdown delimiters. Capability inventory: Orchestration of terraform commands and local file generation. Sanitization: N/A for static content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:28 PM