setting-up-cloudwatch-alarm-notifications
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- Security Best Practices: The skill explicitly instructs the agent to enable encryption for the SNS topic using the AWS managed key (alias/aws/sns) during the setup process, which is a recommended security control.
- IAM Authentication: The instructions correctly specify that the agent must not prompt for passwords, as the underlying platform is expected to use IAM roles and policies for authentication, reducing the risk of credential exposure.
- Parameter Interpolation: The skill accepts user-supplied parameters like alarm names and notification endpoints for interpolation into AWS CLI commands. While this creates a potential surface for indirect prompt injection, it is the intended functionality for resource configuration, and the instructions utilize a controlled execution tool (call_aws).
Audit Metadata