ecs-operation-review
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest and assess configuration data from AWS resources, such as service tags and environment variable names. If this metadata contains instructions designed to manipulate the agent, it could potentially influence the report generation process.\n
- Ingestion points: Configuration data is collected from multiple AWS APIs, including ecs.describeServices, ecs.describeTaskDefinition, and ec2.describeSecurityGroups (SKILL.md).\n
- Boundary markers: While the workflow emphasizes verbatim data recording, it does not specify the use of clear delimiters or guardrail instructions to isolate this untrusted data from the agent's core logic (SKILL.md).\n
- Capability inventory: The skill has access to read-only AWS APIs and the capability to write report files to the filesystem (SKILL.md).\n
- Sanitization: The skill includes a validation step for documentation links via the AWS Knowledge MCP, but does not explicitly outline sanitization procedures for the resource metadata reflected in findings (references/report-format.md).\n- External Library Reference: The skill instructions suggest that the agent may install the
python-docxlibrary to generate DOCX reports if requested by a user. Whilepython-docxis a standard, well-known library, the potential for automated software installation at runtime is a pattern that warrants review. The skill provides a default Markdown output to minimize this requirement (SKILL.md).
Audit Metadata