The Agent Skills Directory

[Command Execution]: The skill provides complex POSIX shell script blocks for the agent to execute via the command line.
Evidence: Found in references/auditing-and-revoking.md and references/approving-access.md. These scripts are used for polling the status of asynchronous AWS DataZone subscription grants and verifying that access changes have successfully settled in the underlying infrastructure (such as Lake Formation or warehouse views). This is a standard operational pattern for infrastructure management.
[Indirect Prompt Injection Surface]: The skill processes data that may be provided by third parties, such as subscription request reasons or catalog listing descriptions, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Data enters the context through fields like requestReason, listing description, decisionComment, and metadata form value (documented in references/access-safety.md).
Boundary markers: The skill explicitly instructs the agent to treat these fields as untrusted data and provides a directive to ignore any embedded instructions (e.g., "run this", "ignore previous instructions").
Capability inventory: The skill possesses the ability to grant, approve, and revoke access to data assets using aws datazone and aws lakeformation commands.
Sanitization: Instructions require the agent to report finding such text to the user rather than executing it or propagating it into other audit fields.
[Information Auditing]: The skill instructs the agent to access sensitive environment metadata, including CloudTrail configurations and Lake Formation permissions.
Evidence: Instructions in references/access-safety.md and references/auditing-and-revoking.md. This access is used legitimately to verify the security posture of the account and to ensure that no out-of-band permissions remain after a revocation, supporting a high-integrity audit process.

managing-data-asset-access