T01 · Skill Instruction Hijacking
Error
- Location
scripts/tf-plan-review.sh:305- Finding
Unconditional Promotional Content Injection into Agent-Facing Results
- Content
View full analysis
- Remediation
View remediation
Security audit
tf-plan-review
Security checks for vulnerabilities and agentic risk
Overview
This Terraform review skill is mostly purpose-aligned, but it overstates its read-only guarantees while automatically running Terraform initialization that can write local files, use credentials, and contact external services.
Install only if you are comfortable letting the agent run Terraform commands in the target repository. Use it in a trusted, preferably disposable workspace with reviewed provider/module sources and scoped cloud credentials. Do not rely on its write:false/read-only claims as meaning no local filesystem changes or dependency/network activity.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/tf-plan-review.sh:106- Finding
Automatic Download and Execution of Project-Controlled Terraform Dependencies
- Content
View full analysis
&2 2>&1; then json_error "$tf init failed. Please run '$tf init' manually in $dir" fi fi ``` The `validate` operation performs similar automatic initialization: ```bash # Initialize if needed if [[ ! -d ".terraform" ]]; then warn "Terraform not initialized. Running $tf init -backend=false..." if ! "$tf" init -input=false -backend=false -no-color >&2 2>&1; then json_error "$tf init failed. Please run '$tf init' manually in $dir" fi fi ``` The project’s security documentation acknowledges this dependency risk: ```markdown | terraform init downloads malicious provider | **Medium** | Only runs init when `.terraform` directory is missing. Uses `-input=false` to prevent interactive prompts. User is responsible for trusting their provider sources. | ``` ### Technical Analysis Terraform configuration controls provider and module source declarations. Running `terraform init` can contact registries or other configured sources and download those dependencies. Subsequent Terraform operations may load and execute provider plugin binaries. The skill performs initialization automatically whenever the `.terraform` directory is absent. It does not require separate user approval, enforce an allowlist of trusted provider or module namespaces, require a pre-existing dependency lock file, or isolate the downloaded components from local credentials and files. The use of `-input=false` only disables interactive prompts; it does not prevent dependency downloads or provider execution. Likewise, `-bac ...[truncated 1743 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is presented as a read-only Terraform plan analyzer, but its documented behavior includes state inspection, validation, and automatic initialization. While these actions are not inherently malicious, they expand capability beyond passive plan parsing and can surprise operators, especially because
terraform initmay change the local workspace and contact external providers/backends.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Cleanup
bash rm -rf /tmp/tf-plan-review-* /tmp/tf-report.mdSecurity Verification
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Cleanup
bash rm -rf /tmp/tf-plan-review-* /tmp/tf-report.mdSecurity Verification
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Cleanup
bash rm -rf /tmp/tf-plan-review-* /tmp/tf-report.mdSecurity Verification
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The explicit 'STRICTLY READ-ONLY' claim is contradicted by code paths that invoke
terraform init, creating a dangerous trust mismatch. Users and higher-level agents may grant this skill access under the assumption it has no side effects, when in fact it can modify the working directory and initiate external interactions.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The tool claims to be strictly read-only, but
terraform initcan write local files, download plugins/modules, and contact remote backends or registries. In hostile or sensitive environments, merely invoking analysis can trigger unintended network access, credential use, backend initialization, and workspace changes, violating the safety contract users rely on.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The validation path silently runs
terraform init -backend=false, which still writes.terraformartifacts and may fetch providers/modules from the network. Because the skill is presented as a read-only analyzer, this hidden initialization can surprise users and create side effects in repositories or CI runners processing untrusted Terraform code.- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The usage text reinforces that the tool never modifies state and is strictly read-only, but implementation performs initialization writes in normal execution paths. This discrepancy increases operational risk because humans and automation may execute the tool on untrusted repos expecting passive analysis, inadvertently allowing networked initialization and local filesystem changes.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README makes a strong 'entirely read-only' claim, but
terraform initis not read-only in the filesystem sense: it creates or updates.terraform/metadata and may update lockfiles. This is primarily a documentation and trust-boundary issue rather than code execution abuse, but users relying on the claim could run the skill in sensitive repositories expecting zero local side effects.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The safety section overstates guarantees by saying the skill is 'Strictly read-only' and implying no disk-side effects, while also documenting
terraform init, which writes local state metadata and possibly dependency/plugin artifacts. In a security-sensitive agent context, inaccurate safety claims are dangerous because they can cause operators to grant broader trust or run the skill in environments where even local mutation is unacceptable.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says the skill is entirely read-only and never writes, but the documented workflow includes Terraform initialization, which performs local filesystem writes. This mismatch can undermine trust boundaries and cause operators or automation to permit the skill under assumptions that are not actually true.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Claiming the skill is 'STRICTLY READ-ONLY' is inaccurate because
terraform initwrites.terraformmetadata, provider plugins, and potentially lock files in the working directory. This can alter repositories, pollute CI workspaces, or trigger unintended backend/provider interactions despite the user's expectation of non-modifying behavior.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Declaring
write: falseand 'NEVER writes' while documentingterraform initcreates a concrete permission-model mismatch. In practice, users or platforms may authorize the skill in read-only contexts where local modification is prohibited, leading to policy bypass or accidental changes to tracked files.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Safety — CRITICAL RULES 1. **NEVER run `terraform apply`** — not even with `-auto-approve`, not even with `-target`, not even "just this one resource". NEVER. 2. **NEVER run `terraform destroy`** — not under any circumstances. 3. **NEVER run `terraform import`** — this modifies state. 4. **NEVER run `terraform taint` or `terraform untaint`** — these modify state.
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The safety section says the skill never writes and should never store plan output, yet it still allows
init, which writes locally. This inconsistency is dangerous because users may rely on the safety guarantees when deciding whether the skill can touch sensitive infrastructure repositories or controlled build environments.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a plan-risk review tool that analyzes Terraform plans before apply, but the script also implements
stateandvalidatesubcommands. Those capabilities go beyond plan analysis and expand the skill's behavior into state inventory and configuration validation, which are not reflected in the stated description.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The documentation says the script does not extract sensitive attribute values, but it also allows use of
terraform show, which can reveal detailed plan or state content if not carefully sanitized. In a skill focused on presenting analysis back to users, that creates a potential secret disclosure path through logs, stderr/stdout, or AI-generated summaries.- Content
Static analysis
No suspicious patterns detected.