terraform-module-creator

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill designs and generates Terraform modules by ingesting data from external MCP tools (such as mcp_terraform_search_modules and azure-documentation), creating a surface where malicious content in external documentation could influence generated code or validation workflows.
  • Ingestion points: mcp_terraform_search_modules, mcp_terraform_get_module_details, azure-documentation, and azure-wellarchitectedframework tools.
  • Capability inventory: Local execution of terraform, tflint, and terraform-docs CLI tools; filesystem write access to create .tf, .yml, .hcl, and .md files.
  • Boundary markers: Absent for external data processing.
  • Sanitization: Absent.
  • [REMOTE_CODE_EXECUTION]: Reference documentation in references/VALIDATION.md suggests a pattern for installing the tflint utility by piping a remote shell script from GitHub directly into the bash shell (curl ... | bash).
  • [EXTERNAL_DOWNLOADS]: The skill requires and instructs the agent to help set up several external third-party tools (Terraform, terraform-docs, tflint) and plugins from their respective GitHub repositories and official registries.
  • [COMMAND_EXECUTION]: The skill's primary workflow involves executing a suite of local command-line tools for infrastructure-as-code formatting, validation, and documentation generation, including terraform fmt, terraform validate, tflint, and terraform-docs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:51 AM