Trust Assessment
new-terraform-provider received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 5 findings: 0 critical, 4 high, 1 medium, and 0 low severity. Key findings include Skill instructs direct shell command execution, Unpinned dependency in `go get` command.
The analysis covered 4 layers: dependency_graph, manifest_analysis, llm_behavioral_safety, static_code_analysis. The llm_behavioral_safety layer scored lowest at 33/100, indicating areas for improvement.
Last analyzed on February 11, 2026 (commit 98272896). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill instructs direct shell command execution The skill explicitly instructs the LLM to execute multiple shell commands (`go get`, `go mod tidy`, `go build`, `go test`). While the commands themselves appear benign in this context, instructing direct shell execution is a high-risk operation. If the LLM's execution environment is not properly sandboxed or if these commands were to be dynamically constructed with untrusted input, it could lead to arbitrary code execution on the host system. Ensure that the LLM executes shell commands in a strictly sandboxed and least-privilege environment. Implement robust input validation and sanitization if any part of the commands could be derived from user input. Consider if direct shell execution is strictly necessary or if a more controlled API could achieve the same outcome. | Unknown | SKILL.md:8 | |
| HIGH | Skill instructs direct shell command execution The skill explicitly instructs the LLM to execute multiple shell commands (`go get`, `go mod tidy`, `go build`, `go test`). While the commands themselves appear benign in this context, instructing direct shell execution is a high-risk operation. If the LLM's execution environment is not properly sandboxed or if these commands were to be dynamically constructed with untrusted input, it could lead to arbitrary code execution on the host system. Ensure that the LLM executes shell commands in a strictly sandboxed and least-privilege environment. Implement robust input validation and sanitization if any part of the commands could be derived from user input. Consider if direct shell execution is strictly necessary or if a more controlled API could achieve the same outcome. | Unknown | SKILL.md:11 | |
| HIGH | Skill instructs direct shell command execution The skill explicitly instructs the LLM to execute multiple shell commands (`go get`, `go mod tidy`, `go build`, `go test`). While the commands themselves appear benign in this context, instructing direct shell execution is a high-risk operation. If the LLM's execution environment is not properly sandboxed or if these commands were to be dynamically constructed with untrusted input, it could lead to arbitrary code execution on the host system. Ensure that the LLM executes shell commands in a strictly sandboxed and least-privilege environment. Implement robust input validation and sanitization if any part of the commands could be derived from user input. Consider if direct shell execution is strictly necessary or if a more controlled API could achieve the same outcome. | Unknown | SKILL.md:12 | |
| HIGH | Skill instructs direct shell command execution The skill explicitly instructs the LLM to execute multiple shell commands (`go get`, `go mod tidy`, `go build`, `go test`). While the commands themselves appear benign in this context, instructing direct shell execution is a high-risk operation. If the LLM's execution environment is not properly sandboxed or if these commands were to be dynamically constructed with untrusted input, it could lead to arbitrary code execution on the host system. Ensure that the LLM executes shell commands in a strictly sandboxed and least-privilege environment. Implement robust input validation and sanitization if any part of the commands could be derived from user input. Consider if direct shell execution is strictly necessary or if a more controlled API could achieve the same outcome. | Unknown | SKILL.md:13 | |
| MEDIUM | Unpinned dependency in `go get` command The skill instructs to fetch a Go module using `go get -u github.com/hashicorp/terraform-plugin-framework@latest`. Using `@latest` means the exact version of the dependency is not pinned. This introduces a supply chain risk, as a future malicious or vulnerable update to the `terraform-plugin-framework` package could be automatically pulled and used, potentially compromising the generated project or the execution environment. Pin dependencies to specific versions (e.g., `github.com/hashicorp/terraform-plugin-framework@vX.Y.Z` or a specific commit hash) to ensure reproducibility and prevent unexpected or malicious updates. Regularly review and update pinned dependencies. | Unknown | SKILL.md:8 |
Scan History
Embed Code
[](https://skillshield.io/report/48c8010c2d9eaff6)
Powered by SkillShield