ClawHub
Back to skill

Security audit

IaC架构师

Security checks for vulnerabilities and agentic risk

Overview

This Terraform skill is mostly purpose-aligned, but it normalizes infrastructure-changing commands and CI/CD applies without clear confirmation or production safety gates.

Install only if you want an agent to help generate and possibly run Terraform workflows. Before allowing exec use, require a plan review first, prohibit production apply/state changes unless you explicitly approve them, use least-privilege cloud credentials, and protect CI/CD production environments with manual approval gates.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill documents destructive Terraform operations such as apply and state modification without an explicit warning that they can create, alter, or destroy real cloud infrastructure. In an agent context with exec capability, omission of confirmation gates can normalize unsafe execution and increase the chance of accidental production-impacting changes.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The CI/CD section describes automated apply after merge but does not require manual approval or environment protection for production. In infrastructure automation, unattended apply can propagate bad changes at scale, causing outages, data loss, or security exposure if a malicious or mistaken change reaches the pipeline.

Static analysis

No suspicious patterns detected.