Terraform Plan Reviewer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:58 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Terraform plan review helper; its flagged items are mostly broad activation wording and CI template hardening concerns, not hidden or malicious behavior.

Install is reasonable for Terraform plan review. Before using any generated GitHub Actions workflow, pin external actions to reviewed commit SHAs, add least-privilege workflow permissions, and verify any backup destination is your own trusted storage.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:297

Finding

GitHub Actions Dependencies Use Mutable Version Tags

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 297–314
Vulnerability Type: Supply-chain risk from mutable CI dependencies
Risk Level: Medium

Vulnerable Code

yaml

- uses: actions/checkout@v4
- uses: hashicorp/setup-terraform@v3
  with: { terraform_version: 1.7.5 }
# ...
- uses: actions/github-script@v7

Technical Analysis

The skill presents this workflow as ready to commit, but its third-party GitHub Actions are referenced through mutable major-version tags. Unlike full commit SHAs, tags such as v4, v3, and v7 do not provide immutable dependency resolution.

If an upstream action repository or release process is compromised, the referenced tag could resolve to modified code. That code would execute automatically on the GitHub-hosted runner with the workflow's available token permissions, environment, checked-out files, and generated Terraform artifacts.

Attack Path

1. An attacker compromises an upstream action repository, maintainer account, or release process.
2. The attacker causes one of the referenced major-version tags to resolve to a malicious commit.
3. A repository adopts the generated workflow without replacing tags with reviewed commit SHAs.
4. A matching pull-request event starts the workflow.
5. GitHub resolves the mutable tag and executes the compromised action.
6. The malicious action accesses repository files, Terraform plan artifacts, or capabilities granted through GITHUB_TOKEN and performs actions permitted by the workflow environment.

This path depends on compromise or malicious modification of an upstream action; no such compromise was observed in the audited project.

Impact Assessment

Potential impact is limited by the runner environment and workflow permissions, but could include:

• Reading checked-out repository content and Terraform configuration.
• Reading generated plan.out and plan.json artifacts.
• Accessing credenti ...[truncated 398 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every external GitHub Action to a reviewed full commit SHA:

   yaml

   - uses: actions/checkout@<full-reviewed-commit-sha>
   - uses: hashicorp/setup-terraform@<full-reviewed-commit-sha>
   - uses: actions/github-script@<full-reviewed-commit-sha>
   

2. Retain the release version in a comment for maintainability:

   yaml

   - uses: actions/checkout@<full-reviewed-commit-sha> # v4.x.x
   

3. Add an explicit least-privilege permissions policy. For example:

   yaml

   permissions:
     contents: read
     pull-requests: write
   

   Reduce this further if a separate job or token can post the review.

4. Use Dependabot or Renovate to propose controlled SHA updates, and review upstream diffs before merging them.

5. Avoid exposing cloud credentials or repository secrets to pull-request workflows unless strictly required. Prefer short-lived, audience-restricted credentials and protected environments.

6. Enforce action allowlists and immutable-SHA policies at the organization level where available.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description lists triggers such as "infrastructure as code", "destroy", "drift", and "plan output", which are broad phrases that can arise in many unrelated conversations. The trigger list does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

For any plan with P1+ findings, the agent emits a pre-apply checklist:

text

[ ] State backed up (s3 cp / gsutil cp / az storage blob copy)
[ ] Manual DB snapshot taken for any stateful resource being touched
[ ] Maintenance window confirmed with stakeholders
[ ] On-call paged or notified

Static analysis

No suspicious patterns detected.