aws-cost-optimize
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various AWS CLI commands to discover infrastructure (EC2, RDS, S3, etc.), retrieve CloudWatch metrics, and query Cost Explorer for billing data.
- [EXTERNAL_DOWNLOADS]: Fetches cost optimization best practices from official AWS documentation (docs.aws.amazon.com), which is a well-known and trusted service.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local Infrastructure-as-Code (IaC) files to identify and understand resource configurations, which represents an attack surface for indirect prompt injection.
- Ingestion points: Reads and parses .tf, .yaml, .json, and .ts files from the local filesystem during the resource discovery phase.
- Boundary markers: The instructions do not specify the use of delimiters or specific warnings to the agent to ignore instructions that might be embedded within the configuration files or their comments.
- Capability inventory: The skill has the capability to execute shell commands via the AWS CLI and create GitHub issues using MCP tools.
- Sanitization: There is no explicit description of sanitizing or validating the content of the IaC files before processing their contents for recommendations.
Audit Metadata