hf-cloud-sagemaker-iam-preflight
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- Local Command Execution: The skill executes the
awsCLI binary using the Pythonsubprocessmodule to interact with AWS services. - Evidence: Found in
scripts/check_role.pyandscripts/create_role.py, wheresubprocess.runis used to invoke AWS IAM and STS commands. - Context: These calls use a list-based argument structure rather than a shell string, which is a recommended practice to mitigate command injection risks.
- IAM Resource Management: The skill possesses the capability to create IAM roles and attach policies, including
AmazonSageMakerFullAccess. - Evidence:
scripts/create_role.pyperformsiam:CreateRole,iam:AttachRolePolicy, andiam:PutRolePolicyoperations. - Context: This functionality is central to the skill's purpose of preparing a SageMaker environment. The skill includes informative logging to guide users who may lack the necessary IAM permissions.
- External CLI Dependency: The skill depends on a pre-installed and configured AWS CLI version 2 on the host system.
- Evidence: Documented in
SKILL.mdand checked at runtime in the scripts usingshutil.which('aws'). - Context: The scripts inherit the caller's existing AWS credentials and environment configuration, ensuring operations are performed within the user's established security context.
Audit Metadata