terraform-module-creator
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill designs and generates Terraform modules by ingesting data from external MCP tools (such as
mcp_terraform_search_modulesandazure-documentation), creating a surface where malicious content in external documentation could influence generated code or validation workflows. - Ingestion points:
mcp_terraform_search_modules,mcp_terraform_get_module_details,azure-documentation, andazure-wellarchitectedframeworktools. - Capability inventory: Local execution of
terraform,tflint, andterraform-docsCLI tools; filesystem write access to create.tf,.yml,.hcl, and.mdfiles. - Boundary markers: Absent for external data processing.
- Sanitization: Absent.
- [REMOTE_CODE_EXECUTION]: Reference documentation in
references/VALIDATION.mdsuggests a pattern for installing thetflintutility by piping a remote shell script from GitHub directly into the bash shell (curl ... | bash). - [EXTERNAL_DOWNLOADS]: The skill requires and instructs the agent to help set up several external third-party tools (Terraform, terraform-docs, tflint) and plugins from their respective GitHub repositories and official registries.
- [COMMAND_EXECUTION]: The skill's primary workflow involves executing a suite of local command-line tools for infrastructure-as-code formatting, validation, and documentation generation, including
terraform fmt,terraform validate,tflint, andterraform-docs.
Audit Metadata