storage-fsx-windows-sla-optimizer
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [Read-Only Data Collection]: The skill is designed to perform only read-only AWS API operations, such as
fsx:DescribeFileSystemsandcloudwatch:GetMetricData. It explicitly forbids any write, create, update, or delete operations, and it does not access file-level data over SMB, maintaining a minimal and safe permissions profile. - [Data Boundary Protection]: The instructions incorporate a robust security boundary for data processed from the environment. In
references/data-collection.md, it specifies that customer-controlled strings like tags or error messages must be treated as untrusted data and used only for display or as validated query parameters, effectively mitigating indirect prompt injection risks. - [Validation Logic]: The skill includes pre-execution validation of user input, such as regex checks for file-system IDs and explicit region requirements. This prevents the agent from making unnecessary or malformed API calls based on invalid input.
- [Trusted Resource Usage]: All external links and documentation references point to official AWS documentation and trusted repositories. The skill uses the agent's native AWS integration for all operations, ensuring that the security context is managed within the platform's existing safety framework.
Audit Metadata