launch-with-aws

SUSPICIOUS. The skill is largely aligned with its stated AWS migration purpose and uses mostly legitimate AWS tooling, but it routes sensitive source code through an opaque remote service with undisclosed domains and then asks the agent to execute deployment steps derived from remote-generated content. The main issues are unverifiable data-flow trust and indirect command-execution risk, not confirmed malware.

No strong evidence of explicit malware (no backdoor, no subprocesses, no obvious credential theft logic, no obfuscated payloads) is present in the provided fragment. The main security concerns are (1) unvalidated network destinations—put_archive() blindly PUTs archive bytes to the provided upload_url, and endpoint/base URL selection is not allowlisted—and (2) uncommon runtime monkeypatching of botocore’s service model loader, which increases supply-chain/behavioral risk. Debug logging of raw error bodies may increase sensitive data exposure depending on log handling and server responses. Overall, treat this as a generally legitimate API/upload client with moderate security risk driven by trust boundaries and endpoint/upload validation gaps.