Volcengine Iac

• Outcome: Review
• Latest audit: Jun 25, 2026 · 6:46 PM UTC
• Version: 1.0.2

Overview

This is a disclosed Volcengine Terraform helper that can make real cloud changes and handle secrets, but the artifacts do not show hidden or malicious behavior.

Install this only if you intend to let an agent help manage Volcengine infrastructure with Terraform. Use least-privilege or temporary credentials, review every Terraform plan, reject auto-approve for apply/destroy, avoid state rm unless you understand the recovery impact, and keep Terraform state plus .volcengine/iac-outputs.json out of git, logs, shared workspaces, and backups.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (51)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to use shell execution, read environment variables containing cloud credentials, and read/write local files, but it declares no permissions or capability boundaries. That mismatch is dangerous because downstream systems and reviewers cannot accurately reason about what the skill is allowed to do, increasing the chance of over-privileged execution and unsafe secret/file handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a mismatch because the description is framed as a policy/decision boundary about when Terraform should be used, emphasizing explicit user choice or safety-oriented Terraform scenarios for Volcengine resources. The actual code does not enforce those conditions; instead, it implements general Terraform helper tooling. Some code does align with the stated safety theme, especially drift detection and plan inspection, but additional capabilities are present that are not mentioned in the description: exporting outputs for another tool, generating tfvars from context, and summarizing plans. These are substantive behaviors beyond the declared purpose, so the description does not accurately represent what the code actually does.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document instructs users to decode cluster kubeconfig and write it to `~/.kube/config`, which can overwrite an existing kubeconfig or merge sensitive cluster credentials into the default location without warning. In an IaC skill, this is more dangerous because users may run setup steps mechanically, exposing production cluster access or disrupting their current kubectl context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The file documents a full Terraform workflow including `terraform apply` and `terraform destroy` against real infrastructure without any explicit warning that these commands create, modify, and delete cloud resources. In an agent skill context, users may copy the sequence verbatim, increasing the chance of unintended provisioning charges, service disruption, or deletion of active resources, especially since the document also describes recovery steps for failed destroy operations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented recovery sequence includes `terraform state rm` and targeted `terraform destroy` commands, which are destructive and can orphan real infrastructure or remove state tracking if copied without careful review. Although the surrounding prose mentions verification context, the command block itself lacks an explicit caution banner immediately adjacent to the destructive steps, increasing the chance that users execute them as routine remediation.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The document recommends `terraform state rm` for VEFAAS release cleanup without an explicit warning that this only detaches Terraform state and does not delete the underlying cloud resource. That can cause orphaned resources, broken drift detection, and unsafe follow-on destroys if copied by users without understanding the state integrity implications.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented command sequence includes `terraform apply` and `terraform destroy` against real cloud resources without an explicit warning that it will create and then delete infrastructure and may incur charges or cause service disruption if reused carelessly. In an agent skill context, users may copy commands verbatim, so omission of safety warnings increases the chance of accidental destructive execution.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The example instructs users to export access and secret keys directly in the shell without warning about secret exposure through shell history, process inspection, logs, or shared terminals. While common in quickstart docs, presenting raw credential handling without safeguards can lead to credential leakage and unauthorized cloud access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example instructs users to export long-lived cloud credentials directly in the shell without any warning about secret handling, shell history exposure, process inheritance, or preference for short-lived credentials. In an IaC skill, this increases the chance users will paste sensitive keys into shared terminals, CI logs, screenshots, or persistent shell profiles, leading to credential compromise.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The verified command sequence includes terraform apply and terraform destroy with no nearby warning that these commands will create billable infrastructure and later delete it. In the context of an agent skill meant to guide real infrastructure changes, omission of safety warnings can cause accidental provisioning, outages, or data loss if users run commands verbatim against non-test environments.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The document includes `terraform apply` and `terraform destroy` in a verified command sequence without an explicit warning that these commands will create billable cloud resources and then delete infrastructure. In an IaC skill, users may copy-paste the sequence directly, so the lack of a nearby caution increases the chance of unintended resource creation, cost, or accidental deletion in the wrong environment or workspace.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented command sequence includes `terraform destroy` without any adjacent warning, confirmation guidance, or explanation of the destructive consequences. In an IaC skill, users may copy-paste the full verified sequence verbatim, which can unintentionally delete real cloud resources if credentials or state point to a non-test environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document includes environment variable exports for cloud credentials alongside `terraform apply` and `terraform destroy` commands, but it does not warn users about secure secret handling, account scoping, or the destructive impact of these operations. In an IaC skill, this increases the chance of accidental credential exposure in shell history/CI logs and unintended creation or deletion of live infrastructure.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The document provides `terraform apply` and `terraform destroy` commands as a verified sequence without an explicit safety warning that these commands will create and later delete real cloud resources in the target Volcengine account. In an IaC skill, this is contextually expected behavior, but the lack of a prominent warning can still lead to accidental infrastructure changes, unexpected charges, or deletion of non-test resources if a user runs the commands in the wrong environment.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document includes `terraform destroy` after state manipulation without an explicit warning that this will delete live cloud resources such as the ECS instance, volumes, networking, and related infrastructure. In an IaC skill, readers may copy the verified sequence directly, so omission of a clear destructive-action warning increases the risk of accidental resource loss and service disruption.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document provides a full Terraform lifecycle including `apply` and `destroy -auto-approve` against real cloud resources, but it does not clearly warn that these commands will create billable infrastructure and then irreversibly delete it. In an agent skill context, users may copy/paste or an automation may surface these commands directly, increasing the chance of accidental resource creation, deletion, and cost impact.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document includes a `terraform destroy -auto-approve` command in a verified command sequence without any adjacent warning, prerequisite confirmation step, or guidance on safe usage. In an IaC skill, destructive commands are especially sensitive because users may copy-paste the sequence verbatim, which can delete live storage resources and associated data if run against the wrong workspace, state, or credentials.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document includes `terraform apply` and `terraform destroy` in a verified command sequence without an explicit warning that these commands create and tear down real cloud IAM resources. In an agent skill context, users may copy the sequence verbatim, so the lack of safety framing increases the chance of unintended infrastructure changes, accidental deletion, or disruption in shared/test accounts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to export cloud credentials and run `terraform apply` and `terraform destroy` with `-auto-approve` but does not include any warning about destructive effects, cost implications, or the need to confirm ownership of the target account/environment. In an IaC skill, this increases the chance of accidental resource creation or deletion, especially if an agent or user follows the sequence mechanically in a real cloud account.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document includes a verified command sequence that performs `terraform apply` and `terraform destroy` against real infrastructure without an explicit warning about cost, service disruption, or data-loss implications. In an agent skill context, presenting destructive IaC commands as a normal validated workflow can lead users or downstream agents to execute them in production-like environments without adequate confirmation or safeguards.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document includes `terraform apply` and `terraform destroy -auto-approve` in a verified command sequence without an adjacent warning that these commands will create and then delete real cloud resources. In an agent skill context, users may copy commands verbatim, and `-auto-approve` removes an important confirmation safeguard, increasing the risk of unintended infrastructure changes or deletion.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document includes a verified command sequence ending in `terraform destroy -input=false` without an adjacent warning that the command will delete provisioned infrastructure and may permanently remove associated database data. In an IaC skill, users often copy command blocks verbatim, so presenting a destructive command as part of the normal workflow materially increases the risk of accidental teardown of live or reused environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document includes `terraform apply -auto-approve` and `terraform destroy -auto-approve -input=false` as a verified command sequence without an adjacent, explicit warning that these commands will create and then permanently delete real cloud infrastructure. In an agent skill context, users or downstream automation may copy or execute the sequence verbatim, increasing the risk of unintended provisioning, cost incurrence, or destructive teardown.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file provides a verified command sequence that includes exporting cloud credentials and running `terraform apply` and `terraform destroy` against real Volcengine resources without an explicit upfront warning that these commands create, modify, and delete live infrastructure. In an agent-skill context, this is dangerous because users or downstream agents may treat the example as safe to run verbatim, leading to unintended resource creation, charges, or destructive teardown.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented command sequence includes destructive Terraform operations (`terraform destroy`) without an explicit warning that they will delete live cloud resources and may incur downtime or data loss if run outside a disposable test environment. In an IaC skill, users often copy command blocks verbatim, so omission of a caution materially increases the chance of accidental destructive execution.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/volcenginecc-blocked.md:602

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/volcenginecc-redis-public-address.md:29

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/volcenginecc-redis.md:31