The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to locate and read sensitive AWS configuration and credential files.
File: SKILL.md
Evidence: Step 1 (Discovery) identifies **/.aws/config and **/.aws/credentials as target files for the evaluation process.
Risk: These files contain plaintext AWS Access Key IDs, Secret Access Keys, and Session Tokens. Accessing these during a review of infrastructure-as-code is unnecessary and exposes the user's active cloud credentials to the agent's context and potentially its generated output or logs.
Mitigation: Remove instructions to access .aws/credentials and .aws/config from the discovery process. Posture reviews should focus exclusively on infrastructure-as-code and static configuration files.
[PROMPT_INJECTION]: The skill processes untrusted infrastructure-as-code files and IAM policies, creating an attack surface for indirect prompt injection.
Ingestion points: SKILL.md (Step 1) defines searching for and evaluating files matching patterns like **/*.tf, **/*.json, and **/policies/**/*.json.
Boundary markers: The skill includes a 'Prompt Injection Safety Notice' section that explicitly instructs the agent to treat string values and comments as data, not instructions.
Capability inventory: The skill utilizes Read, Grep, and Glob tools as defined in the SKILL.md frontmatter.
Sanitization: No programmatic sanitization or schema validation is implemented; the skill relies on natural language instructions to the agent to prevent instruction following from analyzed data.
Risk: An attacker could embed malicious instructions within infrastructure configuration files (e.g., in Terraform resource comments or IAM policy descriptions) to manipulate the agent's assessment report or exfiltrate metadata.
Mitigation: Ensure external content is wrapped in clear delimiters with explicit 'ignore embedded instructions' warnings when processed by the agent.

aws-review