aws-resource-health-diagnose
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from CloudWatch logs, which could theoretically contain malicious instructions designed to influence the agent's diagnostic logic.
- Ingestion points: Log data is retrieved via
aws logs get-query-resultsas described inSKILL.md. - Boundary markers: No specific delimiters or "ignore instructions" markers are defined to isolate log content.
- Capability inventory: The skill provides capabilities to execute AWS CLI management commands such as
aws lambda put-reserved-concurrencyandaws rds reboot-db-instance. - Sanitization: There is no evidence of log content sanitization before the agent processes it for root cause analysis.
- [EXTERNAL_DOWNLOADS]: Fetches troubleshooting and monitoring guidance from the official AWS documentation website (
docs.aws.amazon.com). This is a legitimate and trusted source for technical reference. - [COMMAND_EXECUTION]: Identifies and generates AWS CLI commands for resource discovery, health assessment, and remediation. These commands are intended to be presented to the user for review and execution.
Audit Metadata