spacelift-terraform

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The documentation describes the execution of shell commands through Spacelift lifecycle hooks (e.g., before_init, after_plan, after_run) to automate tasks such as tool installation, validation, and notifications.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official tools like the spacectl CLI via Homebrew, asdf, or direct binary downloads from the vendor's GitHub releases page. It also references official Docker images for running private workers.
  • [INDIRECT_PROMPT_INJECTION]: The platform evaluates data from external Git repositories and CI/CD events (e.g., commit messages, Pull Request labels, and repository-level configuration files) which serve as inputs for OPA Rego policies. The documentation highlights the use of structured policies to manage and secure these ingestion points.
  • [PRIVILEGE_ESCALATION]: Setup instructions for private worker pools include mounting the host's Docker socket (/var/run/docker.sock) into the launcher container, a high-privilege operation necessary for managing runner lifecycles in isolated environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 08:35 AM