The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes multiple example projects containing hardcoded dummy secrets, which are used to demonstrate the migration tool's detection capabilities. While these appear to be placeholders, they match patterns for hardcoded credentials. Evidence:
examples/01-python-boto3-api-gateway/handler.py: CLIENT_SECRET = os.environ.get('CLIENT_SECRET', 'my-super-secret-value')
examples/01-python-boto3-api-gateway/template.yaml: CLIENT_SECRET: my-super-secret-value
examples/05-php-bref-api-gateway/handler.php: 'auth' => ['legacy_client_id', 'legacy_secret_key']
[COMMAND_EXECUTION]: The skill workflow requires the user to execute a local Python script (scripts/analyze_lambda.py) which performs static analysis on the target codebase. While the script itself uses safe parsing methods (AST and Regex), executing code on user-supplied directories is a sensitive operation.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes untrusted source code from AWS Lambda projects.
Ingestion points: The scripts/analyze_lambda.py script accepts a target directory containing arbitrary source code and configuration files (SKILL.md).
Boundary markers: The script does not implement boundary markers or instructions to ignore embedded prompts in the analyzed content.
Capability inventory: The analysis script writes findings to migration_manifest.json, which is subsequently used by the AI agent to generate containerization scripts, Dockerfiles, and Terraform configurations.
Sanitization: The script performs no sanitization of the content extracted via regex or AST analysis before including it in the manifest file.

aws-lambda-to-cloud-run-migration