iam-temp-delegation-review
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill fetches Service Authorization Reference (SAR) data from
servicereference.us-east-1.amazonaws.com. This is an official AWS domain used to provide authoritative grounding for IAM policy analysis. The fetcher includes domain validation to ensure data is retrieved only from trusted AWS endpoints. - [SAFE]: The tool utilizes official AWS SDKs (
boto3) to interact with the IAM Access Analyzer API for provable security checks. It requires specific AWS credentials to function, which is appropriate for its stated purpose as an IAM review tool. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided IAM policy JSON files, which constitutes a potential indirect prompt injection surface. However, the risk is mitigated by the architecture: the agent uses deterministic scripts for the initial analysis and cross-references all semantic findings against authorative SAR data (
sar_context.json) before presenting them to the user. Sanitization and boundary markers are inherent in the pipeline's stage-gated design.
Audit Metadata