aws-rightsizing
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
awsCLI to retrieve resource configurations and utilization metrics from CloudWatch. These operations are restricted to read-only metadata and metrics access. - [DYNAMIC_EXECUTION]: Utilization reports are generated by piping AWS CLI output into
python3 -cfor data processing. This is a local execution pattern used to handle JSON data and perform calculations (e.g., savings estimates and threshold checks). - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the AWS environment, such as Instance IDs and Resource Tags. Security risks are mitigated by using
json.loadfor parsing andsubprocess.runwith argument lists (rather than shell strings) for subsequent CLI calls, preventing data-driven command injection.
Audit Metadata