dd-aws-ccm
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches additional instruction files and scripts from the author's official GitHub repository (datadog-labs/agent-skills). This is a legitimate vendor resource used to maintain modularity.
- [COMMAND_EXECUTION]: Utilizes terraform and aws CLI for infrastructure provisioning and cloud resource discovery. It also uses curl to interact with Datadog's official API endpoints for account validation and registration.
- [DATA_EXFILTRATION]: Accesses local .env and .env.local files to retrieve Datadog API and Application keys. The skill implements a security-hardened pattern of passing these secrets via stdin to curl to avoid exposure in the system's process list or shell history.
- [INDIRECT_PROMPT_INJECTION]: Retrieves AWS account metadata from the Datadog API. The skill mitigates risks by requiring user confirmation for account selection and providing validation checks for configuration parameters before they are used in generated Terraform code.
Audit Metadata