The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill documents the ingestion of data from a remote desktop environment via the screenshot tool (referenced in tools-reference.md). As this data originates from an external desktop environment, it represents a potential injection surface. The skill addresses this by instructing users to implement administrative guardrails like UserControlMode for human oversight, although it does not define automated boundary markers for the desktop content itself. The capability inventory includes extensive keyboard and mouse interaction as well as remote code execution via tool forwarding. Guidance on sanitization includes encrypting screenshot storage and securing typed input.
[Dynamic Execution Capability]: The skill describes a 'Tool Forwarding' feature (referenced in tool-forwarding.md) that allows agents to execute MCP servers directly on a remote Windows host. While this enables dynamic execution of code within the session, the documentation provides clear security considerations, such as limiting the host environment to trusted binaries and using stack-scoped IAM permissions (CallForwardedTool) to ensure restricted access.
[Credential Management]: The instructions correctly identify sensitive artifacts, such as streaming URLs and SAML assertions, which function as bearer tokens for desktop access. It provides best practices for managing these, such as using short-lived validity windows and ensuring tokens are not logged or stored insecurely.
[IAM Scoping Considerations]: A significant portion of the guidance is dedicated to implementing least-privilege IAM policies. It provides specific examples of how to enumerate only necessary actions and scope them to specific AppStream stacks using condition keys.

amazon-workspaces-agent-access