Audit candidate: hashicorp/agent-skills

[xiaolai]

Repo

https://github.com/hashicorp/agent-skills

Field	Value
Stars	522
NL Artifacts	21

Phase 1 Target

Hand-picked for first external audit run. High-credibility repo.

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts
• Security scan passed

[github-actions]

Audit Complete: hashicorp/agent-skills

NL Score: 98/100 | Security: CLEAR | Artifacts: 21 | Strategy: batched

NLPM Audit: hashicorp/agent-skills

Date: 2026-04-06 | Artifacts: 21 | Strategy: batched
NL Score: 98/100
Security: CLEAR
Bugs: 1 | Quality Issues: 18 | Security Findings: 3

NL Score Summary

File	Type	Score	Top Issue
terraform/code-generation/skills/terraform-search-import/SKILL.md	skill	90	Broken reference to ./scripts/list_resources.sh (file does not exist)
terraform/provider-development/skills/provider-actions/SKILL.md	skill	92	4 vague quantifiers: "meaningful", "when relevant", "appropriate" (×2)
terraform/module-generation/skills/refactor-module/SKILL.md	skill	92	4 vague quantifiers: "well-structured", "clear", "proper", "appropriate"
terraform/code-generation/skills/terraform-style-guide/SKILL.md	skill	96	2 vague quantifiers: "meaningful", "where applicable"
terraform/module-generation/skills/terraform-stacks/SKILL.md	skill	96	2 vague quantifiers: "descriptive", "logical"
packer/hcp/skills/push-to-registry/SKILL.md	skill	96	2 vague quantifiers: "meaningful", "minimal"
terraform/code-generation/skills/azure-verified-modules/SKILL.md	skill	98	1 vague quantifier: "adequate"
terraform/code-generation/skills/terraform-test/SKILL.md	skill	98	1 vague quantifier: "specific enough"
terraform/provider-development/skills/run-acceptance-tests/SKILL.md	skill	98	1 vague quantifier: "securely"
terraform/provider-development/skills/provider-resources/SKILL.md	skill	98	1 vague quantifier: "appropriate"
terraform/provider-development/skills/provider-docs/SKILL.md	skill	100	None
terraform/provider-development/skills/new-terraform-provider/SKILL.md	skill	100	None
terraform/provider-development/skills/provider-test-patterns/SKILL.md	skill	100	None
packer/builders/skills/azure-image-builder/SKILL.md	skill	100	None
packer/builders/skills/windows-builder/SKILL.md	skill	100	None
packer/builders/skills/aws-ami-builder/SKILL.md	skill	100	None
terraform/code-generation/.claude-plugin/plugin.json	plugin manifest	100	None
terraform/provider-development/.claude-plugin/plugin.json	plugin manifest	100	None
terraform/module-generation/.claude-plugin/plugin.json	plugin manifest	100	None
packer/hcp/.claude-plugin/plugin.json	plugin manifest	100	None
packer/builders/.claude-plugin/plugin.json	plugin manifest	100	None

Security Scan

Severity	Count
Critical	0
High	0
Medium	2
Low	1

Execution Surface Inventory

Surface	Files
Hooks	None
Scripts	scripts/validate-structure.sh
MCP configs	terraform/code-generation/.claude-plugin/plugin.json (inline), terraform/module-generation/.claude-plugin/plugin.json (inline)
Package manifests	None

Security Findings

#	Severity	File	Line	Pattern	Description

---

Full report: https://github.com/xiaolai/nlpm-for-claude/blob/main/auditor/audits/hashicorp-agent-skills.md

4 bug(s) found. To submit fix PRs to the target repo, add the contribute-approved label to this issue.

[claude]

Contribution run: hashicorp/agent-skills

Audit report: auditor/audits/hashicorp-agent-skills.md
NL Score: 98/100 (excellent — only 1 bug found)
Security: CLEAR

---

PRs created

No PRs were created. The GitHub App token (claude[bot]) does not have permission to fork repositories via the GitHub API (HTTP 403: Resource not accessible by integration). Without a fork, branches cannot be pushed and PRs cannot be opened.

Tracking issue created

hashicorp/agent-skills#56 — [NLPM Audit] Bug report: broken script reference in terraform-search-import

The tracking issue documents:

• The one verified bug: terraform-search-import/SKILL.md references ./scripts/list_resources.sh which does not exist in the repository (only scripts/validate-structure.sh is present). This breaks the primary recommended workflow.
• Two suggested fix approaches (inline terraform command or add the missing script)
• Full NLPM audit methodology and scoring breakdown

Next steps

To submit the actual PR fix, a human maintainer or a token with fork/push permissions would need to:

1. Fork hashicorp/agent-skills
2. In terraform/code-generation/skills/terraform-search-import/SKILL.md, replace the two ./scripts/list_resources.sh code blocks with the equivalent terraform providers schema -json | jq ... command (already documented in the same file), OR add scripts/list_resources.sh as a thin wrapper script.
3. Open a PR referencing [NLPM Audit] Bug report: broken script reference in terraform-search-import hashicorp/agent-skills#56.

[xiaolai]

Contribution Attempt: hashicorp/agent-skills

Date: 2026-04-06
Audit report: auditor/audits/hashicorp-agent-skills.md

Findings Summary

The audit identified 1 bug and 3 medium/low security fixes eligible for PRs.

#	Type	File	Issue
1	Bug	terraform/code-generation/skills/terraform-search-import/SKILL.md	Lines 30–31 and 55–57 reference ./scripts/list_resources.sh which does not exist — breaks the primary recommended workflow
2	Medium security	terraform/code-generation/.claude-plugin/plugin.json	TFE_TOKEN passed to Docker with no scope documentation or image pinning
3	Medium security	terraform/module-generation/.claude-plugin/plugin.json	Same as above (duplicate MCP config block)
4	Low security	packer/builders/skills/windows-builder/SKILL.md	Chocolatey iex+DownloadString example lacks integrity guidance

Status: Blocked — Insufficient Token Permissions

The FORK_TOKEN does not have the required permissions to:

• Fork hashicorp/agent-skills (HTTP 403 on fork endpoint)
• Create issues in hashicorp/agent-skills (GraphQL 403)
• Create repositories under the xiaolai account

The PAT is scoped only to xiaolai/nlpm-for-claude (admin) and hashicorp/agent-skills (read-only). No PRs or tracking issue could be created.

PRs Created

None — blocked by token permissions.

Recommended Manual Action

To submit these fixes manually, a token with public_repo scope (or a fine-grained PAT with "Fork" + "Issues: write" permissions for the target org) is needed. The bug fix is high-impact: the terraform-search-import skill's primary recommended workflow is broken for all users.

[xiaolai]

hashicorp/agent-skills — Contribution Complete

Audit score: 98/100 | Security: CLEAR (0 Critical, 0 High, 2 Medium, 1 Low)

PRs submitted

PR	File	Fix
hashicorp/agent-skills#57	terraform/code-generation/.claude-plugin/plugin.json, terraform/module-generation/.claude-plugin/plugin.json	Pin terraform-mcp-server Docker image to 0.5.0 (was untagged latest, image receives TFE_TOKEN credential)
hashicorp/agent-skills#58	packer/builders/skills/windows-builder/SKILL.md	Add integrity warning to Chocolatey iex+DownloadString install example

Tracking issue

hashicorp/agent-skills#59 — full audit report with methodology, all findings, and PR links.

Notes

• The audit initially flagged a broken ./scripts/list_resources.sh reference in terraform-search-import/SKILL.md. Manual verification showed the script exists at the correct relative path — false positive from the auditor checking only the repo-level scripts/ directory. No PR submitted for this.
• 18 quality issues (vague quantifiers) noted but not PR'd per contribution rules.

[xiaolai]

Already audited (score: 98, CLEAR). hashicorp/agent-skills PRs #57 and #58 submitted.