checkov-policy
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'checkov' package from PyPI. Checkov is a widely recognized and well-known open-source utility for security linting and infrastructure auditing.
- [COMMAND_EXECUTION]: The skill executes several command-line tools including 'pip', 'checkov', and 'terraform' to manage dependencies, execute security scans, and process infrastructure plan files.
- [PROMPT_INJECTION]: The skill is designed to process and analyze external Infrastructure-as-Code (IaC) files, which represents a potential surface for indirect prompt injection.
- Ingestion points: The skill reads various configuration files such as 'main.tf', 'plan.json', and entire directories containing IaC manifests.
- Boundary markers: There are no specific delimiters or instructional constraints provided to ensure the agent ignores potential natural language instructions embedded within comments or metadata of the scanned files.
- Capability inventory: The skill allows for package installation ('pip install') and shell command execution for scanning and infrastructure planning ('checkov', 'terraform').
- Sanitization: The content of the files being analyzed is processed directly by the scanning tool without pre-filtering or sanitization.
Audit Metadata