infrastructure-as-code

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/terraform-ci.sh script downloads the Terraform binary from releases.hashicorp.com to provision the tool in the local execution environment. HashiCorp is a well-known technology provider and this is a standard installation pattern.
  • [COMMAND_EXECUTION]: The utility script scripts/terraform-ci.sh and various Terraform templates execute shell commands and call the AWS CLI to manage cloud resources and security scanning tools.
  • [COMMAND_EXECUTION]: The installation logic in scripts/terraform-ci.sh uses sudo to move the downloaded Terraform binary into /usr/local/bin, requiring elevated privileges.
  • [DATA_EXFILTRATION]: The skill includes functionality to send infrastructure drift detection reports to an external Slack webhook URL, which is provided via the SLACK_WEBHOOK environment variable in scripts/terraform-ci.sh and REFERENCE.md.
  • [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection via the processing of environment-controlled data.
  • Ingestion points: The scripts/terraform-ci.sh script ingests the ENVIRONMENT, TF_VERSION, and ACTION variables from the environment and command-line arguments.
  • Boundary markers: Arguments are filtered through a case statement in scripts/terraform-ci.sh, though environment variables are used directly in URL construction and path mapping.
  • Capability inventory: The skill possesses the capability to execute terraform, aws CLI commands, and sudo system calls.
  • Sanitization: The script uses standard shell safety flags (set -euo pipefail) and validates the ACTION argument against a set of allowed values.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 05:06 PM
Security Audit — agent-trust-hub — infrastructure-as-code