secure-raw-data-backup
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates the backup process using local bash scripts and standard system utilities.
- Evidence: Executes provided scripts
scripts/generate_checksums.shandscripts/backup_to_cloud.shto handle hashing and S3 uploads. - Evidence: Utilizes standard command-line tools including
find,tar,md5sum,du, and the AWS CLI. - [DATA_EXPOSURE_AND_EXFILTRATION]: No unauthorized data exposure or exfiltration patterns were found.
- Evidence: Sensitive configuration details such as bucket names and AWS profiles are managed via a local config file (
~/.config/secure_raw_data_backup/config.sh) rather than being hardcoded or sent to external endpoints. - Evidence: Network activity is restricted to user-configured AWS S3 buckets using official CLI tools.
- [SAFE]: The skill incorporates high-standard security practices for data archival.
- Evidence: Explicitly instructs and documents the setup of S3 Object Lock and versioning to ensure data immutability.
- Evidence: Provides a least-privilege IAM policy template to restrict the backup tool's capabilities to only necessary operations.
- Evidence: Enforces mandatory local checksum generation and verification before allowing data to be streamed to the cloud.
Audit Metadata