aws-agentic-ai
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes services (Gateway, Browser, Memory) that ingest untrusted data from external APIs, websites, and conversation histories. This data is then processed by the agent, creating a surface for indirect prompt injection attacks.
- Ingestion points:
services/gateway/README.md(External REST APIs),services/browser/README.md(Web content extraction),services/memory/README.md(Conversation history). - Boundary markers: The documentation mentions isolated sessions and microVMs, but does not provide specific prompt-level boundary markers or instructions to treat external data as untrusted.
- Capability inventory: The services include code execution (
services/code-interpreter/README.md), browser automation (services/browser/README.md), and API interaction (services/gateway/README.md). - Sanitization: The Browser service documentation recommends sanitizing extracted data, but generic sanitization for LLM consumption is not detailed.
- [DYNAMIC_EXECUTION]: The
Code InterpreterandBrowserservices are designed to execute code (Python, JavaScript) in isolated environments. This is the intended primary purpose of these components and is documented as using secure sandboxes. - [COMMAND_EXECUTION]: Deployment and validation scripts (
deploy-template.sh,validate-deployment.sh) execute shell commands using the AWS CLI and standard development tools (npm, cdk) to manage and verify infrastructure. - [EXTERNAL_DOWNLOADS]: The documentation references installation of SDKs from standard public registries (pip install bedrock-agentcore) and utilizes AWS services (S3, Secrets Manager) for resource management.
Audit Metadata