aws-cdk-development
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/validate-stack.shscript executes thecdk synthcommand. This is the standard mechanism for generating CloudFormation templates from AWS CDK code and is expected behavior for a CDK development utility. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided infrastructure code and configuration files through its validation script, which represents an attack surface for indirect prompt injection if malicious instructions were embedded in the processed files.
- Ingestion points: Project configuration files (
package.json,requirements.txt,pom.xml,go.mod,.csproj) and synthesized CloudFormation templates incdk.out/are read by the validation script. - Boundary markers: None present. The script uses standard utilities like
grepandjqto parse file contents directly. - Capability inventory: The script can execute shell commands via the
cdkCLI and read/analyze files within the local file system. - Sanitization: No sanitization is performed on the content of the infrastructure files before they are analyzed for resource counts or configuration presence.
Audit Metadata