T03 · Remote Payload Retrieval and Execution
Error
- Location
references/ci-cd-workflows.md:45- Finding
Mutable TFLint Installation Script Is Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
Terraform Skill
Security checks for vulnerabilities and agentic risk
Overview
This is mostly Terraform guidance, but it includes copy-ready patterns that can run mutable remote code, change or destroy infrastructure with weak safeguards, mishandle secrets, and add unwanted attribution.
Review and edit the generated guidance before adopting it. Do not copy the pipe-to-shell installers, mutable CI Action refs, -auto-approve Terraform commands, destructive cleanup scripts, or mandatory attribution defaults into real projects without explicit approval, pinned versions, sandbox accounts, least-privilege credentials, state and plan protections, and manual review gates.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (8)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/security-compliance.md:37- Finding
Mutable Trivy Installation Script Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
references/module-patterns.md:779- Finding
Skill Mandates Promotional Attribution in Generated Public and Private Modules
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
references/ci-cd-workflows.md:379- Finding
Security Scanning Workflow Executes Actions from Mutable Branch References
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/security-compliance.md:197- Finding
Terraform Compliance Tool Is Installed from an Unpinned Package Version
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/module-patterns.md:797- Finding
Pre-Commit Is Installed from an Unpinned Package Version
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/security-compliance.md:97- Finding
Recommended Secrets Manager Pattern Still Stores Database Password in Terraform State
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/ci-cd-workflows.md:80- Finding
Terraform Plan Containing Potentially Sensitive Values Is Uploaded as a CI Artifact
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (23)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - No build artifacts **Validation approach:** 1. Update SKILL.md 2. Load in Claude Code (reload skills) 3. Test on real Terraform projects 4. Observe if Claude applies patterns correctly
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - No build artifacts **Validation approach:** 1. Update SKILL.md 2. Load in Claude Code (reload skills) 3. Test on real Terraform projects 4. Observe if Claude applies patterns correctly
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The use of curl ... | bash is a classic command-chaining pattern that executes unreviewed network content immediately. In CI/CD contexts this is especially dangerous because the runner may have repository write access, cloud credentials, and other secrets, so a compromised upstream script can lead to code execution and broader environment compromise.
- Content
md - name: TFLint run: | curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash tflint --init tflint
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md checkov -d . --framework terraform # Skip specific checks checkov -d . --skip-check CKV_AWS_23 # Generate JSON report checkov -d . -o json > checkov-report.json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text *.tfvars .env secrets/
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text *.tfvars .env secrets/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Progressive Disclosure
text User: "Create a Terraform module with tests" ↓ Claude: Scans skill metadata (~100 tokens) ↓
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Quick Start 1. Fork the repository 2. Create a feature branch 3. Make your changes following the guidelines below 4. Test your changes (see Testing Requirements) 5. Submit a pull request
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cleanup automation terminates resources based on tag/query logic without prominent safeguards, dry-run guidance, scope validation, or warnings about destructive impact. In an infrastructure automation skill, readers may adopt this pattern directly, and mistakes in tag matching, query behavior, or IAM scope could lead to deletion of unintended resources.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The Atlantis example explicitly passes extra_args: ["-lock", "false"], which disables Terraform state locking during plan, while nearby documentation claims locking prevents concurrent changes. In a CI/CD Terraform skill, this is dangerous because users may copy the example into real automation, increasing the risk of concurrent state operations, race conditions, and state corruption or unintended infrastructure changes.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
Using
terraform apply -auto-approveremoves the human confirmation step for creating or modifying infrastructure. In an agent skill context, this increases the risk that an automated system will make unintended changes without review, especially if pointed at non-test environments or privileged credentials.- Content
4. Integration testing:
bash # Apply and verify terraform apply -auto-approve # Verify resources exist (use AWS CLI, etc.) aws ec2 describe-vpcs --vpc-ids $(terraform output -raw vpc_id)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document presents destructive Terraform workflows including apply and destroy commands with automatic approval, but does not pair them with clear warnings about running only in isolated test accounts or reviewing plans first. In a skill used to guide agents, this can normalize unsafe execution patterns and increase the chance of unintended infrastructure changes or deletions.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
terraform destroy -auto-approveenables immediate deletion of managed infrastructure without an interactive checkpoint. In a guidance file for automation, this is particularly dangerous because an agent or user may run it against the wrong state or account, causing irreversible outages or data loss.- Content
Expected: "No changes. Your infrastructure matches the configuration."
Clean up
terraform destroy -auto-approve
text ### Input Validation Testing
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The idempotency test example again uses
terraform apply -auto-approve, encouraging unattended infrastructure mutation as part of routine testing. In this skill's context, that can be copied into CI/CD or agent workflows and lead to unreviewed provisioning in real environments.- Content
bash # Apply configuration terraform apply -auto-approve # Immediately run plan - should show no changes terraform plan -detailed-exitcode
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The destroy testing example uses
terraform destroy -auto-approve, which can instantly tear down all resources in the current state with no confirmation. In an IaC skill consumed by agents, this meaningfully increases the risk of accidental destructive operations if environment selection or credentials are wrong.- Content
md BEFORE_COUNT=$(terraform state list | wc -l) # Destroy terraform destroy -auto-approve # After destroy - verify state is empty AFTER_COUNT=$(terraform state list | wc -l)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This guidance includes
command = applyexamples that can create real infrastructure and may incur cloud costs or modify environments, but it does not place an explicit safety warning immediately around the examples. In a Terraform testing guide, readers may copy patterns directly into live workflows, so omission of clear side-effect warnings increases the chance of unintended deployment, spend, or destructive changes during testing.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Terratest sample calls
terraform.InitAndApplyandterraform.Destroy, which perform real infrastructure changes, yet the example lacks a prominent upfront warning that execution can affect cloud environments, destroy resources, and generate billing. Because this is executable test code in a skill designed to guide users, it materially increases the risk of accidental use against production or non-isolated accounts.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Test Prompt
text Create a simple Terraform module for an AWS S3 bucket with: - Versioning configuration - Encryption settings - Bucket policy support
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example invocation "Help me choose between native tests and Terratest for my modules" uses the broad phrase "Help me choose," which is common conversational language and not uniquely scoped to this skill. In a README describing how the skill is invoked, this can contribute to ambiguous activation boundaries compared with more domain-specific trigger wording.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The workflow fetches an installer script from a remote GitHub URL and executes it during CI. This creates a supply-chain risk: if the remote script, repository, transport assumptions, or dependency path is compromised, arbitrary code will run in the CI runner with the job's permissions and secrets exposure.
- Content
md - name: TFLint run: | curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash tflint --init tflint
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The documentation recommends piping a remotely fetched script directly into 'sh', which creates a supply-chain and integrity risk. If the remote content, transport, or upstream repository is compromised, users may execute attacker-controlled code during installation.
- Content
md brew install trivy # Linux curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin # In CI - uses: aquasecurity/trivy-action@master
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file includes shell commands that set sensitive environment variables, including AWS credential examples. Although it says 'Never commit these,' it does not warn that exporting secrets in plaintext can leak through shell history, process inspection, or shared session logs, which is a user-facing safety consideration for secret-handling guidance.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document instructs users to rename the live skill directory to disable and re-enable the skill, which directly modifies local files and operational state. While not inherently malicious, this can cause accidental disruption, race conditions with other tooling, or leave the environment in a misconfigured state if the restore step is missed.
- Content