The Agent Skills Directory

Source Code Ingestion and Upload: The skill zips and uploads local source code to a remote AWS service for analysis and migration planning. While this involves sending data externally, the skill implements several safety measures:
Secret Filtering: It automatically excludes common sensitive files (e.g., .env, .pem, .ssh, .aws) and build artifacts from the upload archive.
User Confirmation: The instructions mandate that the agent must obtain explicit user approval before any code is uploaded or any deployment execution begins.
Network Security and Domain Validation: The skill interacts with external resources (GitHub for source fetching and AWS for API calls). The configuration scripts include strict validation to ensure that network traffic is restricted to official AWS domains (.api.aws, .amazonaws.com, .awsapps.com), which helps mitigate risks associated with unauthorized data exfiltration.
Indirect Instruction Surface: During the migration process, the skill produces a DEPLOY.md file that the agent is instructed to read and follow for local deployment. This represents an indirect prompt injection surface; however, the instructions are produced by a trusted AWS-managed service and the agent's actions are scoped to the deployment of the specific migrated application.
Local Credential Management: To support persistent sessions, the skill stores authentication tokens in the user's home directory (~/.launch-with-aws/session.json). The skill provides a sign-out command that revokes the remote session and deletes the local credential file, following standard security practices for CLI-based authentication.
Subprocess Execution: The skill uses Python's subprocess module to call git for file enumeration and to spawn a sibling process for handling the OAuth callback. These calls are implemented safely using argument lists rather than shell strings, preventing typical command injection vulnerabilities.

launch-with-aws