aws-ops
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates extensive interaction with the local system and AWS APIs via the
awsCLI. Key capabilities include managing EC2 instance lifecycles (start-instances,stop-instances), invoking Lambda functions (lambda invoke), and modifying local Kubernetes configurations (eks update-kubeconfig). - [DATA_EXFILTRATION]: The skill provides commands to access and retrieve sensitive architectural and operational data from the AWS environment. This includes listing IAM users and roles, simulating security policies, downloading S3 objects to the local filesystem (
s3 cp), and reading CloudWatch log events. - [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). It ingests untrusted data from multiple sources including CloudWatch log streams (
aws logs tail), EC2 resource tags, and S3 object names. - Ingestion points: Untrusted content enters the agent context through command outputs from
aws logs tail,aws logs get-log-events, andaws ec2 describe-instances(via Tags). - Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore embedded instructions within these data streams.
- Capability inventory: The skill possesses powerful capabilities that could be abused if an injection succeeds, such as executing Lambda functions, stopping critical EC2 instances, or syncing local data to S3.
- Sanitization: There is no evidence of sanitization or filtering of the retrieved data before it is processed by the LLM.
Audit Metadata