signing-in-to-aws
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to execute precondition checks (
aws --version,aws sts get-caller-identity,aws configure list) "silently" before asking for user confirmation. This behavior bypasses explicit user consent for initial system discovery commands. - [COMMAND_EXECUTION]: The skill uses local shell execution for all its primary functions, including
aws login,aws sts get-caller-identity, andaws configure listto manage and verify authentication states. - [DATA_EXFILTRATION]: The skill accesses sensitive AWS environment metadata, specifically the AWS Account ID and ARN via
aws sts get-caller-identity. While the skill does not attempt to send this data to an external URL, the access happens without initial user approval. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect injection surface by processing untrusted data from the local environment.
- Ingestion points: The skill reads and processes the output of shell commands like
aws --versionandaws sts get-caller-identitywithinSKILL.md. - Boundary markers: None identified; command output is treated as trusted context for the agent's flow logic.
- Capability inventory: The agent has full access to the local shell to run the
awsCLI and potentially other commands requested by the user. - Sanitization: There are no instructions or mechanisms mentioned to sanitize or validate the output from the shell commands before the agent acts upon it.
Audit Metadata