aws-compute
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents fleet operations via AWS Systems Manager (SSM) Run Command and State Manager, which can ingest untrusted data from user-supplied parameters or external triggers.
- Ingestion points: Untrusted data can enter the agent context through parameters passed to
aws ssm send-command(documented inreferences/systems-manager.md) oraws autoscaling create-auto-scaling-groupvia user data or lifecycle hooks. - Boundary markers: The documentation does not provide specific prompt boundary markers, but it explicitly warns the user to 'validate and escape' input before use.
- Capability inventory: The skill utilizes capabilities including remote shell execution, infrastructure provisioning with bootstrap scripts, and modifying instance metadata/policies across an AWS account.
- Sanitization: The documentation in
references/systems-manager.mdproactively identifies the risk, stating that 'unsanitized values flow into shell execution on the fleet and are a command-injection path.' - [COMMAND_EXECUTION]: The skill provides numerous AWS CLI command templates for managing cloud infrastructure. While these are legitimate administrative tools for the skill's purpose, they allow for high-impact operations such as instance termination, security group modification, and code execution on managed nodes, which require careful handling by the agent.
Audit Metadata