gcp-to-aws
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with various command-line interfaces, including
gcloud,aws,terraform, anddocker, to inventory GCP resources and validate AWS configurations. These interactions are governed by a strict security contract that limits execution to read-only list/describe verbs and uses field projection to avoid capturing sensitive values. - [DYNAMIC_EXECUTION]: To handle data processing and migration tasks, the skill generates temporary Python extraction scripts and localized shell scripts (e.g.,
ai-migration/setup_bedrock.sh,scripts/02-migrate-data.sh). These scripts are designed for user-initiated execution and include dry-run defaults and environment variable validation. - [INDIRECT_PROMPT_INJECTION]: Because the skill must ingest external data such as Terraform files and application source code, it includes robust mitigations requiring the agent to treat these inputs as passive data and disregard any embedded commands that attempt to hijack the migration workflow.
Audit Metadata