Terradev GPU Cloud

• Risk level: Low
• Analyzed: Feb 23, 2026, 11:09 PM
• Findings: 0
• Version: 1.0.1

Overview

The skill's requested binaries, install, and environment variables are consistent with a multi-cloud GPU provisioning tool, but it requires many high-privilege cloud credentials so use least-privilege keys and verify the terradev-cli package before installing.

This skill looks internally consistent for multi-cloud GPU provisioning, but it requires many sensitive credentials and can perform destructive, billable actions. Before installing: - Verify the terradev-cli package source (review the GitHub repo and package metadata) and inspect its code/dependencies if possible. - Use least-privilege credentials: create service accounts/roles with only the permissions needed (provisioning, tagging, listing), not full admin/root keys. - Prefer ephemeral keys or scoped service accounts and set billing alerts/quotas to limit accidental charges. - Be aware the agent will read local credential files you point it to (e.g., GCP_CREDENTIALS_PATH, ORACLE_PRIVATE_KEY_PATH); ensure those files are protected and use dedicated keys for this tool. - Test in a sandbox account first and run terradev CLI with --dry-run to validate behavior. - If you will allow autonomous agent invocation, limit that to trusted agents or require explicit user confirmation for provisioning/destroy actions. If you cannot or do not want to provide many provider keys, consider using the skill with only a single provider (e.g., RunPod) or decline installation.