The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various CLI tools including terraform, aws, curl, and jq to manage AWS infrastructure and Datadog integrations. It employs secure practices by passing sensitive credentials via stdin to curl headers and utilizing environment variables for Terraform to avoid exposure in process lists.
[EXTERNAL_DOWNLOADS]: The skill includes a mechanism to download additional skill definitions from the official datadog-labs/agent-skills repository on GitHub. This is used to hand off tasks to related tools such as the account setup or AWS integration skills.
[DYNAMIC_EXECUTION]: The skill dynamically generates Terraform HCL configuration files and AWS policy JSON documents based on user input and environmental discovery. These generated files are subsequently executed using terraform apply and applied via the AWS CLI.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data fetched from the user's AWS environment, creating an attack surface where malicious metadata could influence the agent.
Ingestion points: Fetches data using aws s3api list-buckets, get-bucket-location, get-bucket-policy, and get-bucket-encryption in Phase 2.
Boundary markers: The instructions do not define specific boundary markers or warnings to the agent to ignore potentially malicious content embedded within AWS metadata.
Capability inventory: The skill has the capability to write files, execute shell commands, and perform network operations via the vendor's API.
Sanitization: Basic normalization is performed on AWS region names and organization IDs, but external policy content is not sanitized before interpolation into Terraform templates.

dd-aws-storage-management