cloudtrail-cost-optimization
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- Secure Data Handling Practices: The skill explicitly identifies that ingested metadata (such as trail names, S3 bucket names, and resource tags) is untrusted. It instructs the agent to treat these values as inert data and ignore any instruction-like text embedded within them, effectively mitigating indirect prompt injection risks.
- Read-Only Operations: The skill strictly limits itself to read-only AWS API calls (Describe, Get, List). It contains clear boundaries preventing any mutation operations (Create, Update, Delete) on CloudTrail or CloudWatch resources, ensuring the skill cannot be used to modify the cloud environment.
- Verification and Validation Loops: A dedicated validation step is included in the workflow, requiring the agent to self-check findings for evidence and audit impact before generating reports. This reduces the risk of hallucinations or misleading recommendations.
- Safe External References: All external links provided in the skill point to authoritative AWS documentation and official support forums, ensuring that the agent and user are directed to trusted sources for cost optimization guidance.
Audit Metadata