aws-cost-optimization
Warn
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The helper function
ce_queryinSKILL.mduses theevalcommand to execute an AWS CLI command string built from variables. If the variables$start,$end,$granularity, or$group_byare populated with unsanitized input containing shell metacharacters, it could result in arbitrary command execution on the host. - [DATA_EXFILTRATION]: The skill's discovery phase utilizes
aws sts get-caller-identityto retrieve and display the AWS Account ID and IAM ARN. While necessary for context in a cost optimization tool, this exposes sensitive account identifiers to the agent's context.
Audit Metadata