aws-vpc-dns-investigation
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- Structured Diagnostic Framework: The skill implements a methodical approach to DNS troubleshooting, distinguishing between live diagnosis (Mode A) and pre-change validation (Mode B). This structure helps prevent ad-hoc reasoning and ensures that VPC-level attributes are checked before resolution results are interpreted.
- Read-Only Operation: As stated in the documentation and enforced by the instructions, the skill is designed to be read-only. It drives observation and simulation tools without taking action on the actual DNS configuration.
- Trusted Dependency Management: The skill relies on the
aws-vpc-dns-diagnosticsMCP server. The documentation correctly identifies this as a prerequisite and points to the official AWS GitHub repository for the server source and deployment instructions. - IAM and Boundary Awareness: The skill includes specific instructions for handling cross-account constructs, marking them as opaque rather than absent if they cannot be read. It also correctly identifies SSM reachability as a necessary condition for live probing and instructs the agent to report its absence as a blocker.
- Pre-Change Simulation: A core capability of the skill is symbolic simulation of proposed DNS changes. This allows for impact assessment (e.g., identifying potential NXDOMAIN results or broad forwarding sweeps) before any changes are recommended to the user.
Audit Metadata