Alibabacloud Terraform Code Generation

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Alibaba Cloud Terraform generator with expected file, network, validation, and opt-in plan behavior, but users should understand that plan can use existing cloud credentials.

Install only if you want an agent to write Terraform files in a project directory and run Terraform validation steps. Do not paste access keys into prompts or HCL, review generated Terraform before applying it yourself, and only request terraform plan when you intentionally want Terraform to use your existing Alibaba Cloud credential setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The optional plan workflow probes multiple local credential locations and environment indicators even though the skill's primary purpose is code generation. Enumerating credential-source presence reveals sensitive environmental information and expands the skill into local security-context inspection, which may be unnecessary and privacy-invasive.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The skill states it must never read credentials, yet Step 8 checks whether credential environment variables are set and whether credential files exist. Even without printing secret values, this still reads sensitive state and can disclose the presence of secrets, contradicting the safety contract and undermining trust boundaries.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal