serverless

Warn

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: MEDIUMPROMPT_INJECTION
Full Analysis
  • [OBFUSCATION]: Eight reference files (architecture-patterns.md, code-organization.md, deployment-pipelines.md, error-handling.md, performance-optimization.md, security-best-practices.md, state-management.md, and testing-strategies.md) contain exactly 150 redundant sections each, repeating the same 3-4 generic technical paragraphs. This massive redundancy is characteristic of noise-injection techniques meant to bury instructions or bypass automated scanners.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements event handlers that ingest untrusted data from external triggers with an active capability set.
  • Ingestion points: handlers/users.py (line 74) via APIGatewayRestResolver and references/event-sources.md via SQSEvent handlers.
  • Boundary markers: Absent; untrusted JSON bodies and event records are processed directly into the agent context without delimiters.
  • Capability inventory: The skill utilizes IAM roles with dynamodb:PutItem and ssm:GetParameter permissions, allowing external data to influence the state of the backend database or read configuration.
  • Sanitization: Validation is limited to checking for the presence of specific fields (e.g., email), with no escaping or filtering of content prior to data store operations.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 12, 2026, 06:38 PM
Security Audit — agent-trust-hub — serverless