opentofu-modules
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOW
Full Analysis
- [COMMAND_EXECUTION] (INFO): The skill references the use of
task(Go Task) and thetofuCLI to run tests and format code. These are standard development tools intended for local execution within the repository context. - [INDIRECT_PROMPT_INJECTION] (LOW): The skill handles untrusted data in the form of user-provided infrastructure requirements to generate HCL code.
- Ingestion points: User prompts used to populate
variables.tfandmain.tftemplates. - Boundary markers: None explicitly defined in the templates.
- Capability inventory: Execution of
task tg:testwhich triggerstofu teston generated HCL. - Sanitization: The skill mitigates risks by strictly enforcing
command = planin test blocks, ensuring that even if malicious configuration is generated, it is validated without executing side effects or creating real cloud resources.
Audit Metadata