Trust Assessment
iac-terraform received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include HCL Injection and Path Traversal in Module Scaffolding Script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on August 1, 2026 (commit 1489c33a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | HCL Injection and Path Traversal in Module Scaffolding Script The `scripts/init_module.py` script takes a user-supplied `module_name` and directly interpolates it into Terraform configuration templates (such as `main.tf`) using Python's `.format()` without sanitization or escaping. An attacker can craft a malicious module name containing HCL syntax (e.g., injecting a `null_resource` with a `local-exec` provisioner) to execute arbitrary shell commands when `terraform plan` or `terraform apply` is run. Additionally, the script does not sanitize the module name against path traversal (e.g., `../../`), allowing arbitrary file creation/overwrite outside the target directory. Validate the `module_name` argument using a strict regular expression (e.g., `^[a-z0-9-]+$`) to ensure it only contains lowercase alphanumeric characters and hyphens, preventing both path traversal and HCL injection. | LLM | scripts/init_module.py:215 |
Scan History
Embed Code
[](https://skillshield.io/report/b4168c45ae0988b3)
Powered by SkillShield