pantheon-ai/terragrunt-validator
Comprehensive toolkit for validating, linting, testing, and automating Terragrunt configurations, HCL files, and Stacks. Use this skill when working with Terragrunt files (.hcl, terragrunt.hcl, terragrunt.stack.hcl), validating infrastructure-as-code, debugging Terragrunt configurations, performing dry-run testing with terragrunt plan, working with Terragrunt Stacks, or working with custom providers and modules.
73
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The SKILL.md "Documentation Lookup (MANDATORY for ALL detected custom resources)" workflow explicitly requires the agent to fetch and read external documentation via Context7 MCP calls or WebSearch/registry/Git URLs (e.g., "mcp__context7__get-library-docs", WebSearch queries, and https://registry.terraform.io links) for each detected custom provider/module, which are untrusted third‑party sources whose instructions can materially change configuration, authentication, and next actions.
Where we found it
context7.com
domain · 9 sites
The SKILL.md Documentation Lookup workflow (lines 289-330) explicitly requires the agent to call Context7 MCP endpoints (mcp__context7__resolve-library-id and mcp__context7__get-library-docs) to fetch documentation for every detected custom provider/module, making the Context7 service a third-party content source whose responses can control the agent's subsequent actions.
registry.terraform.io
domain · 3 sites
The SKILL.md Documentation Lookup workflow (line 306) and the detection script (line 329) explicitly direct the agent to visit registry.terraform.io URLs to fetch module documentation, making the Terraform Registry a third-party content source whose content can influence the agent's validation decisions.
SKILL.md
306
https://registry.terraform.io/modules/{source}/{version}
631
https://registry.terraform.io/
scripts/detect_custom_resources.py
329
https://registry.terraform.io/modules/{clean_source}
WebSearch results
content-type · 7 sites
The SKILL.md Documentation Lookup workflow (lines 298, 307, 322) and troubleshooting section (lines 438, 452) explicitly require the agent to use WebSearch to fetch documentation from arbitrary web sources (provider docs, Git repo READMEs, version-specific queries), making WebSearch results a third-party content source whose content can control the agent's subsequent actions.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill mandates runtime calls to Context7 MCP endpoints (mcp__context7__resolve-library-id and mcp__context7__get-library-docs) to fetch documentation that is then injected into the agent's workflow, so these external endpoints are required at runtime and can directly control prompts.
Where we found it
mcp__context7__resolve-library-id
dependency · 4 sites
The SKILL.md Documentation Lookup workflow explicitly requires the agent to call the Context7 MCP endpoint mcp__context7__resolve-library-id at runtime to resolve library IDs for custom providers/modules, making this an unverifiable external dependency that the plugin invokes and whose responses directly control the agent's subsequent documentation fetching.
SKILL.md
295
mcp__context7__resolve-library-id
SKILL.md
304
mcp__context7__resolve-library-id
SKILL.md
317
mcp__context7__resolve-library-id
SKILL.md
339
mcp__context7__resolve-library-id
mcp__context7__get-library-docs
dependency · 5 sites
The SKILL.md Documentation Lookup workflow explicitly requires the agent to call the Context7 MCP endpoint mcp__context7__get-library-docs at runtime to fetch documentation for custom providers/modules, making this an unverifiable external dependency that the plugin invokes and whose responses are injected into the agent's workflow and directly control validation decisions.
SKILL.md
296
mcp__context7__get-library-docs
SKILL.md
305
mcp__context7__get-library-docs
SKILL.md
318
mcp__context7__get-library-docs
SKILL.md
343
mcp__context7__get-library-docs
SKILL.md
348
mcp__context7__get-library-docs
- Audited
- Security analysis