opentofu
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of infrastructure management commands such as
tofu applyandpulumi upwhich execute resource provisioning logic. It also includes an example of aremote-execprovisioner usingsudofor system updates on provisioned instances, which is a standard though high-privilege practice in infrastructure as code. - [EXTERNAL_DOWNLOADS]: The skill references external modules and providers from sources like the OpenTofu registry, GitHub, and S3. It also provides GitHub Actions workflows that utilize official and well-known actions from the
actions,opentofu,pulumi, andaws-actionsorganizations for CI/CD pipelines. - [INDIRECT_PROMPT_INJECTION]: The GitHub Actions pattern for commenting plan results on pull requests (in
cicd-integration.md) processes the stdout of thetofu plancommand. While this output is wrapped in markdown code blocks to prevent interpretation, it represents a surface where infrastructure metadata is reflected back into the development environment.
Audit Metadata