The Agent Skills Directory

Secure Data Handling: The skill manages sensitive log and trace data through official AWS APIs (boto3). For Dynamic Instrumentation snapshots, it implements secure file writing using owner-only permissions (0600) and O_NOFOLLOW to prevent symlink attacks, ensuring captured data is not exposed locally.
Built-in Security Documentation: The skill includes extensive 'Security Considerations' and 'Operating Contract' sections. These provide proactive guidance on encrypting log groups, avoiding breakpoints on authentication logic, and managing the risk of capturing PII or secrets.
Restricted API Dispatch: The Python scripts (e.g., di_gateway.py and di_logs_client.py) use a defensive allowlist pattern for AWS API calls. This prevents the agent or the scripts from being used to execute arbitrary unauthorized AWS operations.
Input Validation: Input parameters such as trace IDs and session IDs are validated against strict regular expressions (e.g., hex-only for trace IDs) before being interpolated into SQL queries, effectively preventing injection attacks.
Trusted Vendor and Resources: The skill is authored by 'aws' and all network operations are directed at official AWS service endpoints. The dependencies (boto3, botocore) are standard and well-maintained.

aws-observability