infrastructure-as-code
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/terraform-ci.shscript downloads the Terraform binary fromreleases.hashicorp.comto provision the tool in the local execution environment. HashiCorp is a well-known technology provider and this is a standard installation pattern. - [COMMAND_EXECUTION]: The utility script
scripts/terraform-ci.shand various Terraform templates execute shell commands and call the AWS CLI to manage cloud resources and security scanning tools. - [COMMAND_EXECUTION]: The installation logic in
scripts/terraform-ci.shusessudoto move the downloaded Terraform binary into/usr/local/bin, requiring elevated privileges. - [DATA_EXFILTRATION]: The skill includes functionality to send infrastructure drift detection reports to an external Slack webhook URL, which is provided via the
SLACK_WEBHOOKenvironment variable inscripts/terraform-ci.shandREFERENCE.md. - [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection via the processing of environment-controlled data.
- Ingestion points: The
scripts/terraform-ci.shscript ingests theENVIRONMENT,TF_VERSION, andACTIONvariables from the environment and command-line arguments. - Boundary markers: Arguments are filtered through a case statement in
scripts/terraform-ci.sh, though environment variables are used directly in URL construction and path mapping. - Capability inventory: The skill possesses the capability to execute
terraform,awsCLI commands, andsudosystem calls. - Sanitization: The script uses standard shell safety flags (
set -euo pipefail) and validates theACTIONargument against a set of allowed values.
Audit Metadata