Terraform Ai Skills

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:35 AM UTC
• Version: 0.0.2

Overview

This Terraform maintenance skill is not evidently malicious, but it needs Review because it can make bulk repository and release changes while documented safety controls are missing or not enforced.

Install only after review. Treat this as powerful repository automation: run it in a disposable checkout or sandbox first, add passive and reviewed config files, verify the exact repository list, and do not rely on DRY_RUN or CREATE_PR until the scripts are fixed to enforce them. Avoid granting broad GitHub tokens, and manually review any branch, tag, release, or workflow changes before allowing organization-wide execution.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/batch-provider-upgrade.sh:8

Finding

Arbitrary Code Execution Through Executable Configuration Files

Content

View full analysis

/dev/null; then echo " ✅ $config is valid" else echo " ❌ $config has syntax errors" FAILED=$((FAILED + 1)) fi done ``` ### Technical Analysis The `source` command does not parse a configuration file as passive data. It evaluates the entire file as Bash code in the current shell process. A configuration file can therefore contain command substitutions, function definitions, redirections, external commands, or arbitrary shell statements in addition to expected variable assignments. Checking that required variable names are present with `grep` does not make the file safe. A malicious file can define all required variables and then execute an unrelated payload. The test suite compounds this issue because a command described as configuration validation executes every `config/*.config` file. This turns a routine test into a code-execution entry point. The distribut ...[truncated 1723 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: run-with-provider.sh:44

Finding

Path Traversal in Script Selection Allows Execution Outside the Approved Scripts Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create-releases.sh:59

Finding

Bulk Release Script Ignores Documented Dry-Run and Pull-Request Safety Controls

Content

View full analysis

/dev/null ``` The configuration reference advertises controls that the script does not enforce: ```text | `CREATE_PR` | Create PR instead of direct commit | `false` | | `RUN_TERRAFORM_VALIDATE` | Run `terraform validate` | `true` | | `RUN_TERRAFORM_FMT` | Run `terraform fmt` | `true` | | `RUN_TFLINT` | Run TFLint | `false` | | `RUN_TFSEC` | Run TFSec | `false` | | `SEMANTIC_VERSIONING` | Use semantic versioning for releases | `true` | | `TAG_PREFIX` | Version tag prefix | `v` | | `USE_EMOJIS` | Emojis in changelogs | `true` | | `DRY_RUN` | Preview changes without applying | `false` | | `VERBOSE` | Enable verbose output | `false` | ``` ### Technical Analysis The script does not inspect `DRY_RUN` or `CREATE_PR` before performing remote mutations. It also does not request interactive confirmation before processing all matching repositories. As a result: - `DRY_RUN=true` does not prevent commit ...[truncated 2151 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (35)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CONTRIBUTING.md (reported line 231)May include surrounding context.

git reset --hard

4. Force push (if needed and safe)

git push --force-with-lease

text

## Support

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SECURITY.md (reported line 67)May include surrounding context.

md

- **Don't run on production** without testing
- **Don't share tokens** publicly
- **Don't ignore errors** during execution
- **Don't bypass safety checks**

## Known Security Considerations

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SECURITY.md (reported line 67)May include surrounding context.

md

- **Don't run on production** without testing
- **Don't share tokens** publicly
- **Don't ignore errors** during execution
- **Don't bypass safety checks**

## Known Security Considerations

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 80)May include surrounding context.

pull-requests: write # If using PR workflow

text

**Recommendation:** Use fine-grained personal access tokens with repository-specific scope.

### 2. Secrets Management

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The supplied code is narrowly focused on validating Terraform modules and examples across matching repositories. It does not upgrade providers, standardize GitHub Actions workflows, automate semantic releases, run security scans, or perform broader end-to-end repository maintenance as described. While validation could be a supporting step within a larger maintenance workflow, this code chunk’s actual behavior is materially narrower and different from the declared purpose, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad automation skill for managing many Terraform module repositories and performing upgrades, workflow standardization, releases, scans, and maintenance. The supplied code chunk does not implement any of those primary functions. Instead, it performs a narrow local validation task: checking configuration files for required variables and syntax correctness. While config validation could be a supporting utility inside a larger maintenance tool, this chunk's actual behavior is materially different from the declared primary purpose and does not demonstrate the advertised repository-management capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'What Gets Done Automatically' and expected-results sections highlight automatic provider upgrades, workflow standardization, validation, changelog updates, and GitHub release creation, but omit prominent warnings about the operational and supply-chain risk of those actions. In a Terraform bulk-management skill covering 10–200+ repositories, missing warnings and approval gates materially increase the chance of widespread unintended changes or releases.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/SAFETY.md (reported line 82)May include surrounding context.

md

# Option A: Revert the commit
git revert HEAD
git push origin $DEFAULT_BRANCH

# Option B: Hard reset (if no one else pulled)
git reset --hard HEAD~1

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CONTRIBUTING.md (reported line 228)May include surrounding context.

git push origin $DEFAULT_BRANCH

Option B: Hard reset (if no one else pulled)

git reset --hard HEAD~1 git push --force-with-lease origin $DEFAULT_BRANCH

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/SAFETY.md (reported line 85)May include surrounding context.

git push origin $DEFAULT_BRANCH

Option B: Hard reset (if no one else pulled)

git reset --hard HEAD~1 git push --force-with-lease origin $DEFAULT_BRANCH

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document describes bulk Terraform maintenance across many repositories but does not prominently require an explicit warning or confirmation about the scale and side effects before action. In an AI-agent context, this can lead to accidental mass modifications, releases, or workflow changes across 10–200+ repos if a user request is interpreted too broadly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 139)May include surrounding context.

md

# In scripts:
send_slack_notification() {
  curl -X POST $SLACK_WEBHOOK_URL \
    -H 'Content-Type: application/json' \
    -d "{\"text\":\"$1\"}"
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file includes git reset --hard and a force-push sequence that can discard local changes and rewrite remote history. Although the section says 'if needed and safe,' it does not clearly warn readers about data loss, history rewriting, or the need to confirm repository state before running the commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README’s primary usage flow encourages bulk Terraform maintenance and release automation across many repositories, but the main quick-start section does not clearly warn that these actions can modify infrastructure code, CI workflows, version constraints, and release state at scale. In a skill explicitly designed for 10–200+ repositories, this omission increases the chance that a user triggers broad, unintended changes without first understanding the blast radius or validating safeguards.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

/plugin install terraform-ai-skills@anmolnagpal

Manual

git clone https://github.com/anmolnagpal/terraform-ai-skills ~/.claude/skills/terraform-ai-skills

text

## Requirements

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill encourages bulk modifications, workflow changes, tagging, and release actions across many repositories, but the user-facing guidance does not prominently warn that these actions can be destructive or irreversible at organizational scale. In an AI-assisted context, that increases the chance of mass unintended changes, broken CI/CD, or erroneous releases if a user invokes the skill without guardrails or explicit confirmation steps.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · docs/ENV-VARS.md (reported line 51)May include surrounding context.

md

- `COPILOT_CONFIG` - Path to config file to use
- `DRY_RUN` - Show what would happen without making changes
- `VERBOSE` - Enable verbose logging
- `SKIP_VALIDATION` - Skip validation steps
- `FORCE` - Force operation even with warnings

## Example Usage

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This example instructs the agent to perform full maintenance across many repositories, including upgrades, workflow fixes, releases, and example updates, without an explicit warning that it may modify numerous repositories and publish releases. In the context of an agent skill designed for bulk Terraform maintenance, that omission increases the risk of users triggering large-scale changes they may not fully anticipate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The usage example tells Copilot to upgrade all AWS provider versions across an organization but does not warn that this may cause widespread repository modifications. Because the skill targets 10–200+ repositories at scale, an ambiguous bulk command can lead to unintended edits, commits, or downstream CI/release activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Although this example is framed as selective updates, it relies on pattern-based matching and still lacks a warning that all matched modules will be modified. Regex- or pattern-based targeting can be broader than a user expects, especially in automation tooling that operates across many repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The migration guidance encourages users to run full maintenance after only brief testing, but it does not explicitly warn that the operation may perform broad changes across multiple repositories, workflows, changelogs, and releases. In a maintenance skill with end-to-end automation, this can normalize high-impact actions without sufficient caution or staged rollout guidance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide repeatedly instructs users to invoke a different skill namespace, terraform-multicloud-skills, rather than the declared skill terraform-ai-skills. In an agentic environment, mismatched identity and config paths can cause the wrong configuration, prompts, or scripts to be loaded, potentially leading users to execute unintended automation against the wrong repositories or trust unverified content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The examples encourage bulk provider upgrades across many matching repositories without any warning about scope, confirmation, dry-run behavior, or review requirements. In the context of Terraform and multi-repo maintenance, this can drive high-impact unintended changes to infrastructure code, workflows, and release pipelines at scale if a user or agent follows the example blindly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick reference encourages a broad natural-language request to perform 'full maintenance on all terraform modules' without requiring scope confirmation, dry-run behavior, or approval checkpoints. In this skill's context, that can trigger high-impact changes across many repositories, including upgrades, workflow edits, validations, and releases, increasing the chance of unintended mass modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Telling users to 'Always start with prompt #4 - it does everything you need' promotes an ambiguous catch-all action with no safety constraints. Because prompt #4 is described as performing end-to-end maintenance, the wording discourages incremental review and can cause overbroad automation across infrastructure repositories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.