terraform-iac
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the official
hashicorp/terraform-mcp-serverimage from Docker Hub. As HashiCorp is a well-known and established technology provider, this external dependency is considered safe. - [CREDENTIALS_SAFE]: The instructions correctly advocate against hardcoding secrets, recommending the use of environment variables (
TFE_TOKEN) for authentication to HCP Terraform. - [INDIRECT_PROMPT_INJECTION]: The skill ingests documentation and module metadata from the Terraform Registry, creating a theoretical surface for indirect prompt injection.
- Ingestion points: External data is fetched via
get_provider_details,get_module_details, andget_policy_detailsfrom the Terraform Registry. - Boundary markers: No specific delimiters are defined in the skill instructions to separate external content from instructions.
- Capability inventory: The skill facilitates workspace management, variable set creation, and execution of Terraform runs via the MCP server.
- Sanitization: No explicit sanitization or filtering logic is defined for the fetched documentation content.
Audit Metadata