aws-iot-greengrass
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides component recipes (e.g.,
s3-uploader/recipe.json,comprehensive-component-recipe.yaml) that useinstallandrunlifecycle scripts to execute shell commands. These commands include package management viaapt-getandpip3, as well as runtime execution of Python and Java artifacts. - [COMMAND_EXECUTION]: Setup instructions in
setup-greengrass-container.mdandsetup-greengrass-lite-container.mdrequire the agent to run containers with elevated privileges using the--privilegedand--initflags. These permissions are necessary for the Greengrass runtime to manage component lifecycles and system resources on the host. - [EXTERNAL_DOWNLOADS]: The skill automates the download of software and SDKs from trusted vendor repositories and well-known services. Specifically, it clones the Greengrass Lite source code and the Component SDK from the
aws-greengrassGitHub organization and installs standard libraries likeawsiotsdkandboto3from official package registries. - [REMOTE_CODE_EXECUTION]: The
export_ggv1.shutility script facilitates the migration of Greengrass V1 Lambda functions by downloading their code artifacts. It uses theaws lambda get-functioncommand to retrieve a temporary presigned URL from the user's AWS account and then useswgetto fetch andunzipthe code for local processing.
Audit Metadata