terraform-skill

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Installation steps for development utilities such as tflint and trivy in the provided CI/CD and security examples utilize the piped shell execution pattern (curl | bash).
  • [EXTERNAL_DOWNLOADS]: Fetches installation scripts and binaries from external GitHub repositories for Aqua Security and Terraform Linters to support linting and security scanning.
  • [COMMAND_EXECUTION]: Provides shell scripts intended to automate the cleanup of cloud resources, such as EC2 instances, using the AWS CLI in references/ci-cd-workflows.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user infrastructure requirements to generate Terraform configurations, creating an attack surface for indirect instructions.
  • Ingestion points: User-provided infrastructure descriptions and variable values used during the code generation process.
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands in the processed data.
  • Capability inventory: The generated configurations can execute shell commands and perform network operations via Terraform providers and CI/CD pipelines.
  • Sanitization: Present; the skill provides examples and best practices in references/module-patterns.md for implementing input validation blocks within Terraform configurations to restrict variable values.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 04:19 AM