The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various AWS CLI commands through the Bash tool to perform infrastructure discovery. All commands are strictly read-only (Describe, List, Get) as defined in the programmatic check files (e.g., security-checks.md, cost-checks.md).
[EXTERNAL_DOWNLOADS]: The skill references resources from the official aws-samples GitHub organization and amazonaws.com domains. These are trusted sources for AWS documentation, samples, and official CLI tools, used here for installation guidance and fetching framework-aligned assessment instructions.
[DYNAMIC_EXECUTION]: Includes a Python script (scripts/generate-html-report.py) to generate visual reports from the assessment findings. The script processes local Markdown files and generates local HTML output using standard libraries without performing network operations.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the user's AWS environment (e.g., resource names, tags, and configurations). While this is a potential ingestion point for untrusted data, the skill uses structured parsing and focuses on architectural metrics, which significantly mitigates the risk of command or prompt injection from environment data.
[CREDENTIALS_SAFE]: Implements a mandatory validation step (credential-boundary.md) that inspects the active IAM session. It explicitly blocks execution if the credentials contain any write, create, or delete capabilities, enforcing a zero-risk posture for the user's production environment.

aws-well-architected-review