firehose-operation-review
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- Secure API Usage: The skill uses native AWS control-plane APIs (Firehose, CloudWatch, and Service Quotas) for data collection. These operations are performed in a read-only manner through the agent's existing infrastructure, following standard DevOps practices.
- Data Access Boundaries: Instructions explicitly state that the skill does not put or read delivered record content, transform Lambda code, or destination data, ensuring that sensitive data payloads remain private.
- Infrastructure Auditing Purpose: The skill is designed to improve security posture by identifying gaps such as disabled encryption, missing backups, or over-permissioned IAM roles. These checks are defensive and align with security best practices.
- Indirect Prompt Injection Surface: The skill ingests metadata from resource tags and descriptions via AWS APIs. While this represents a potential surface for indirect prompt injection, it is used for its intended purpose of auditing and is limited to control-plane configuration data.
Audit Metadata