launch-with-aws
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [Command Execution]: The skill uses Python's subprocess module to interact with Git for file enumeration and to manage a local OAuth callback server. These operations are scoped to the project environment and are used to implement the migration and authentication workflows.
- [Data Exposure Protection]: A dedicated archival process (archive.py) implements best-effort filtering to exclude common sensitive files (e.g., .env, SSH keys, AWS credentials) before source code is uploaded to the migration service.
- [Network Safety]: The configuration ensures that authentication and API requests are only sent to validated AWS domains (.api.aws, .amazonaws.com, .awsapps.com) and validates that remote hosts do not resolve to private or loopback addresses.
- [Authentication Best Practices]: Implements OAuth 2.0 with PKCE for secure authentication. Session tokens are stored locally with restricted file permissions (0600) to protect against unauthorized access.
- [Human-in-the-loop Controls]: The agent instructions include mandatory confirmation gates before uploading source code or starting the infrastructure deployment, ensuring the user maintains control over their data and costs.
Audit Metadata