aws-investigation
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFE
Full Analysis
- Standard Resource Access: The skill describes common procedures for interacting with AWS services such as CloudWatch Logs, DynamoDB, S3, and Lambda. These activities are consistent with the skill's stated purpose of account investigation and use standard AWS CLI patterns.
- Data Handling Practices: The instructions emphasize accuracy and provenance, requiring that claims be backed by specific artifacts or records. It includes guidelines for handling pagination and literal values (e.g., quoting error codes exactly) which supports reliable reporting.
- Indirect Prompt Injection Surface: Like any skill that processes external data such as logs or data store records, there is a theoretical surface for indirect prompt injection if those records contain malicious instructions. However, the skill's focus is on factual extraction and evidence-based reporting rather than executing or interpreting the content as instructions.
- Ingestion points: Processes data from CloudWatch Logs, S3 buckets, and DynamoDB tables (documented in
references/data-investigation.md). - Boundary markers: Encourages quoting values exactly and maintaining provenance notes to separate evidence from inference (documented in
SKILL.md). - Capability inventory: Primarily read-only operations including
ListResources,GetLogEvents,DescribeTable, andGetTemplate. - Sanitization: Instructs the agent to report exact field values and quote error messages word-for-word.
Audit Metadata