agentcore-mcp-oauth-facade
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's README.md references an installation command that fetches content from the author's official GitHub repository (aws-samples).
- [COMMAND_EXECUTION]: The documentation provides Python code snippets for handling tool list pagination, session ID injection, and tool name mapping. These snippets are illustrative and follow standard practices for protocol adaptation.
- [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by advising users to store HMAC keys in AWS Secrets Manager and delegating token issuance to Amazon Cognito rather than generating them within the facade.
- [DATA_EXFILTRATION]: The architecture includes security controls such as redirect URI validation against allow-lists and signed state parameters to mitigate common OAuth vulnerabilities like open redirects.
- [PROMPT_INJECTION]: The skill instructions were audited for malicious prompt injection patterns, role-play attacks, or instructions to ignore safety filters. No such patterns were found.
Audit Metadata