Back to skill
Skillv0.2.1
ClawScan security
tf-plan-review · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousFeb 21, 2026, 11:40 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill mostly does what it claims (analyzes Terraform plans read‑only) but there are several mismatches between its documentation/metadata and what the script actually does (missing declared runtime dependencies, temporary plan file on disk, and running terraform init), so you should review those differences before trusting it with live credentials or production directories.
- Guidance
- Before installing or running this skill: - Expect to have jq and terraform (or tofu) on PATH — the registry metadata incorrectly lists no required binaries. Confirm these are present. - Review the included scripts yourself (scripts/tf-plan-review.sh) before trusting it in production. The script is mostly conservative, but it does run `terraform init` if the directory is not initialized, which creates/changes .terraform and can download providers/modules from the network. - If you are concerned about downloading untrusted providers, run the tool in a sandbox or on a copy of the repo that has already been initialized, or set TF_BINARY to a vetted wrapper. - The script writes the plan JSON to a secure temporary file and removes it on exit, but temporary files can persist until deleted; avoid running it on hosts where tmp is not trusted or where disk-forensics is a concern. - Do not grant this skill more credentials than necessary. Because it relies on Terraform, it will use whatever provider credentials Terraform finds; run it with least privilege or in a read-only/staging account if possible. - The discrepancies (metadata omitting dependencies, SKILL.md claiming purely in-memory while script uses a temp file) justify manual review; if you cannot review the script, treat the skill as potentially risky and test it in isolated environments first.
Review Dimensions
- Purpose & Capability
- noteThe skill's name/description (Terraform plan risk analysis) aligns with the included script and SKILL.md. However, the registry metadata declares no required binaries or env vars while the code clearly depends on terraform (or tofu) and jq, and optionally timeout/gtimeout. That metadata omission is an incoherence that could mislead users or automated installers.
- Instruction Scope
- concernSKILL.md instructs agents to run the supplied script which runs `terraform plan -json`, `terraform validate`, `terraform state` queries and — when not initialized — runs `terraform init`. The docs repeatedly claim 'strictly read-only', but `terraform init` will create/modify the .terraform directory and may download providers/modules (network activity). The script writes plan output to a temporary file (mktemp) rather than entirely in-memory, contradicting some SKILL.md/README claims about never caching plan output to disk. The script contains no apparent instructions to exfiltrate data or contact third parties beyond normal Terraform/provider network activity.
- Install Mechanism
- okThere is no install spec (instruction-only + script). This is low-risk from a package-download perspective because nothing fetches arbitrary archives during installation. The script will, however, trigger provider/module downloads when running `terraform init` in a directory that needs initialization — a normal Terraform behavior and documented in SECURITY.md.
- Credentials
- noteThe skill declares no required environment variables or credentials and does not request unrelated secrets. It does support TF_BINARY and TF_PLAN_TIMEOUT. It relies on the user's Terraform provider credentials indirectly (Terraform uses credentials) which is proportionate for a plan analysis tool. The registry metadata omission of terraform/jq is the main proportionality mismatch to be aware of.
- Persistence & Privilege
- notealways:false and normal autonomous invocation settings. The script does create a temporary file for plan JSON and may create/update the .terraform directory via `terraform init` (documented as an allowed exception). It does not modify Terraform state or call terraform apply/destroy. Creating .terraform and temporary files is a modest level of persistence; understand that `terraform init` may download provider binaries into .terraform which are then present on disk.