Terraform Cloud

Terraform Cloud — manage workspaces, runs, plans, state, and variables via REST API

This skill appears to be a Terraform Cloud CLI and asks only for TFC_TOKEN and TFC_ORG (expected). However: 1) review the bundled scripts/terraform-cloud.py before installing — it will read a .env fallback at $WORKSPACE/.env or ~/.openclaw/workspace/.env (undocumented in SKILL.md). 2) Verify the script's request paths (it leaves '{org}' placeholders and may not substitute them), so test on non-production data first. 3) Use a least-privilege TFC token (limited scope) and avoid placing high-privilege tokens in shared .env files. 4) If you don't trust the publisher, don't install — or run the CLI manually in an isolated environment/VM and inspect behavior during basic operations. If you want, I can point out the exact lines that read the .env and the places where '{org}' is not substituted.

Type: OpenClaw Skill Name: terraform-cloud Version: 1.0.0 The skill bundle provides a functional CLI for managing Terraform Cloud resources via its REST API. The code in `scripts/terraform-cloud.py` uses standard Python libraries and follows expected patterns for credential management (reading from environment variables or a local `.env` file). Although the script contains minor functional bugs—specifically, failing to correctly format the organization name into several API endpoint paths (e.g., using literal '{org}' in strings)—there is no evidence of malicious intent, data exfiltration, or unauthorized command execution. All network requests are directed to the legitimate Terraform Cloud API domain (app.terraform.io).