The Agent Skills Directory

Handling of Administrative API Keys: The skill includes scripts for measuring usage via OpenAI, Anthropic, and OpenRouter APIs. These operations require administrative keys, which are handled through a temporary file protocol designed to minimize exposure. The instructions specify that the agent must delete these files immediately after use, reducing the risk of accidental credential leakage.
Sensitive File Exclusion: A significant security feature is the explicit instruction to skip scanning of secret and configuration files such as .env, .pem, and credentials.json. This 'hard exclusion' rule helps prevent the unintended ingestion of sensitive project information into the agent's context.
Indirect Prompt Injection Surface: The skill is designed to scan user source code and process workload profiles. This constitutes an entry point for untrusted data. However, the instructions provide clear guidance to treat this information strictly as data and to ignore any embedded directives, which serves as a protective measure against prompt injection attempts within the scanned code.
External API Interaction: The usage measurement scripts communicate with external endpoints (api.openai.com, api.anthropic.com, openrouter.ai). These are well-known technology services directly related to the skill's purpose. The communication is limited to specific, read-only usage endpoints, adhering to the principle of least privilege.

bedrock-migration-assessment