terraform-style-guide skill: security examples contradict their own guidance (allowed_roles wildcard, password output in state)

[jrx]

Found while vendoring the skill into a downstream repo and running an automated review over the vendored files. Three issues in terraform/code-generation/skills/terraform-style-guide/:

1. Vault example grants all roles (SECURITY.md)

The "secure" Vault example uses:

allowed_roles = ["*"]

which contradicts the least-privilege guidance at the top of the same file. An explicit role name (or a clearly marked allowlist placeholder) would keep generated configurations from broadening database-secret access.

2. Typo in the same example (SECURITY.md)

name = "postrgres-db" should be "postgres-db".

3. Password output example conflicts with state-protection guidance (SKILL.md)

output "database_password" {
  description = "Database administrator password"
  value       = aws_db_instance.main.password
  sensitive   = true
}

sensitive = true only redacts display; the value still lands in state and in any consumer's state. Since the skill elsewhere warns about protecting secrets in state, the example should either omit the output or note the state implication and point to a secret-manager or ephemeral-value workflow.

Happy to send a PR for any or all of these if useful.