Security audit
Security checks for vulnerabilities and agentic risk
This Terraform skill is mostly purpose-aligned, but it normalizes infrastructure-changing commands and CI/CD applies without clear confirmation or production safety gates.
Install only if you want an agent to help generate and possibly run Terraform workflows. Before allowing exec use, require a plan review first, prohibit production apply/state changes unless you explicitly approve them, use least-privilege cloud credentials, and protect CI/CD production environments with manual approval gates.
The skill documents destructive Terraform operations such as apply and state modification without an explicit warning that they can create, alter, or destroy real cloud infrastructure. In an agent context with exec capability, omission of confirmation gates can normalize unsafe execution and increase the chance of accidental production-impacting changes.
The CI/CD section describes automated apply after merge but does not require manual approval or environment protection for production. In infrastructure automation, unattended apply can propagate bad changes at scale, causing outages, data loss, or security exposure if a malicious or mistaken change reaches the pipeline.
No suspicious patterns detected.
