Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent infrastructure-as-code reference skill whose risky commands are expected for managing cloud resources, but users should still verify accounts and preview changes before running deployment or deletion examples.
Before installing or using this skill, treat its IaC commands as capable of changing real cloud infrastructure and incurring cost. Run previews first, confirm the target account, region, workspace, stack, and environment, avoid production unless intentional, pin container images and provider versions, and be especially careful with destroy or delete examples.
The quick-start workflow includes terraform apply and terraform destroy with no adjacent warning that these commands make real changes to live cloud resources and may incur cost or data loss. In a skill intended for agent use, omission of guardrails increases the chance an automated or inattentive user executes destructive actions in the wrong environment.
The EC2 user_data launches a Docker image via ${var.docker_image} without demonstrating that the image must be pinned to an immutable tag or digest. In IaC, this can lead to non-reproducible deployments or accidental/malicious image substitution if a mutable tag like latest is used, causing different code to run on later applies.
The environment-specific apply example directly selects or creates a workspace and then runs terraform apply -var-file="env/$ENV.tfvars" without a warning or approval checkpoint. This pattern can steer users or agents into making unintended live changes across environments, especially if $ENV is mis-specified or credentials point to production.
The CloudFormation CLI examples include create, update, and delete operations without clearly warning that they affect deployed resources and may create costs, outages, or permanent deletion. In agent-consumable documentation, these are operationally risky because they normalize direct execution of powerful commands without environment validation.
The Pulumi quick-start shows pulumi up and pulumi destroy as routine workflow commands without an explicit warning about live resource modification and deletion. In the context of an infrastructure skill, this can cause accidental changes or teardown when copied verbatim by users or autonomous agents.
No suspicious patterns detected.
