volcengine-landing-zone
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute terraform and the Volcengine CLI (ve) for provisioning cloud resources. It also employs local-exec provisioners within Terraform blueprints to automate CLI-based tasks that are not yet supported by the native provider, such as billing and account tagging operations.
- [DYNAMIC_EXECUTION]: Several blueprints dynamically generate and execute shell scripts and inline Python scripts to facilitate cross-account credentials exchange (AssumeRole) and service status checks. These scripts are generated at runtime within the workspace to bridge the gap between Terraform outputs and CLI inputs.
- [SAFE]: The skill enforces a strict solution confirmation protocol (G1) that requires the user to review a generated HTML plan before any infrastructure changes are initialized.
- [SAFE]: All execution is isolated to a designated writable workspace (G3), ensuring that the read-only built-in blueprints are not modified by the agent.
- [SAFE]: Sensitive information, such as initial passwords, is handled through a mandatory file-display protocol (G4) that prevents credentials from being exposed in chat history, favoring local file delivery for user review.
Audit Metadata