Terraform

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:06 PM UTC
• Version: 1.0.4

Overview

This Terraform skill gives purpose-aligned infrastructure guidance and includes cautions around risky state and apply operations rather than hiding or automating them.

Before installing, understand that Terraform advice can affect real cloud resources if you let an agent run the commands. Require review of saved plans, backups before state surgery, and explicit approval before apply, state push, state rm, or force-unlock; do not put secrets into this skill's config or memory files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Hand-editing state JSON | Serial and lineage mismatch corrupts the backend copy — or worse, the push succeeds | `state mv`/`rm`/`push` on a pulled backup (Core Rules 2) |
| `ignore_changes = all` | Freezes the entire resource forever; future config edits become silent no-ops | Ignore the one attribute, with a comment saying who writes it (`lifecycle.md`) |
| Treating plan success as apply safety | Plan validates config against state, not against the cloud: quotas, IAM, name collisions, and eventual consistency all surface at apply | Apply early in a sandbox account; keep changes small so failures are attributable |
| `apply -auto-approve` outside CI | Removes the only human checkpoint between a typo and deleted production | Auto-approve only in a pipeline applying a reviewed saved plan |
| Committing `terraform.tfstate` or `.terraform/` | Ships every secret in state to git history and leaves everyone on a different copy | Gitignore both; commit `.terraform.lock.hcl` |
| Module source pinned to a branch (`?ref=main`) | The build changes under you with no diff in your repo | Tag refs (`?ref=v1.2.3`) or registry versions |
| `depends_on` sprinkled to fix ordering | Hides a missing attribute reference and, at module level, defers every data source inside to apply time | Reference the attribute you actually need; pass explicit values between modules |

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown section includes state surgery commands such as `terraform state rm`, `terraform state push`, `terraform state replace-provider`, and `terraform force-unlock`, which can alter infrastructure state and recovery conditions. Although a backup is recommended, the file does not clearly warn that these operations are high-risk and can damage state or cause resource drift if used incorrectly.

Session Persistence

Medium

• Category: Rogue Agent

Content

The object is alive and unmanaged; nothing is broken yet.

- Best: restore the previous state version (above) — one operation, no ambiguity.
- Otherwise: `import` it back at exactly the same address. Get the address from your PR or from the backup you took before the surgery.
- Never "fix" it by letting the next apply create a replacement. That leaves a live orphan billing forever next to its new twin.

• Confidence: 55% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This markdown file includes `terraform state rm 'module.legacy'`, which removes tracked resources from Terraform state and can affect all resources in the module. Although the text advises counting resources first, it does not clearly present this as a destructive operation requiring explicit caution about losing management of those resources.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

- State backend: pipeline role can read/write; humans read only via a break-glass path that is audited.
- No `terraform_remote_state` across a trust boundary — it grants read of the whole state file, secrets included (`state.md`).
- Plan artifacts expire on a schedule and are not world-readable in the CI UI.
- Provider credentials come from OIDC federation per environment, not from long-lived keys in CI secrets (`ci.md`).
- Nothing in this skill's configuration is a secret: `config.yaml` holds preferences, credentials come from the environment.

• Confidence: 70% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Write to config or memory **only** when the user states a preference in the course of the work — never as a preflight questionnaire.

- User names a binary, cloud, backend, environment layout, platform list, parallelism, or how much plan detail they want to see → update the matching key in `~/Clawic/data/terraform/config.yaml`.
- User expresses a stance or habit (appetite for `state` surgery, whether `-auto-approve` is ever acceptable, tagging and naming conventions, required policy engine, drift-check cadence, wanting warnings up front versus on request) → record it under the relevant preference area (tooling, conventions, platform, safety posture, workflow, compliance, output format, cadence) in `~/Clawic/data/terraform/memory.md`.
- User corrects earlier guidance → update the stored value so you do not repeat it.

If the user has said nothing, store nothing. Credentials, role ARNs, and secrets are never stored here — they belong in the environment (`secrets.md`).

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Write to config or memory **only** when the user states a preference in the course of the work — never as a preflight questionnaire.

- User names a binary, cloud, backend, environment layout, platform list, parallelism, or how much plan detail they want to see → update the matching key in `~/Clawic/data/terraform/config.yaml`.
- User expresses a stance or habit (appetite for `state` surgery, whether `-auto-approve` is ever acceptable, tagging and naming conventions, required policy engine, drift-check cadence, wanting warnings up front versus on request) → record it under the relevant preference area (tooling, conventions, platform, safety posture, workflow, compliance, output format, cadence) in `~/Clawic/data/terraform/memory.md`.
- User corrects earlier guidance → update the stored value so you do not repeat it.

If the user has said nothing, store nothing. Credentials, role ARNs, and secrets are never stored here — they belong in the environment (`secrets.md`).

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Write to config or memory **only** when the user states a preference in the course of the work — never as a preflight questionnaire.

- User names a binary, cloud, backend, environment layout, platform list, parallelism, or how much plan detail they want to see → update the matching key in `~/Clawic/data/terraform/config.yaml`.
- User expresses a stance or habit (appetite for `state` surgery, whether `-auto-approve` is ever acceptable, tagging and naming conventions, required policy engine, drift-check cadence, wanting warnings up front versus on request) → record it under the relevant preference area (tooling, conventions, platform, safety posture, workflow, compliance, output format, cadence) in `~/Clawic/data/terraform/memory.md`.
- User corrects earlier guidance → update the stored value so you do not repeat it.

If the user has said nothing, store nothing. Credentials, role ARNs, and secrets are never stored here — they belong in the environment (`secrets.md`).

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.