serverless
Warn
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: MEDIUMPROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: Eight reference files (architecture-patterns.md, code-organization.md, deployment-pipelines.md, error-handling.md, performance-optimization.md, security-best-practices.md, state-management.md, and testing-strategies.md) contain exactly 150 redundant sections each, repeating the same 3-4 generic technical paragraphs. This massive redundancy is characteristic of noise-injection techniques meant to bury instructions or bypass automated scanners.
- [INDIRECT_PROMPT_INJECTION]: The skill implements event handlers that ingest untrusted data from external triggers with an active capability set.
- Ingestion points: handlers/users.py (line 74) via APIGatewayRestResolver and references/event-sources.md via SQSEvent handlers.
- Boundary markers: Absent; untrusted JSON bodies and event records are processed directly into the agent context without delimiters.
- Capability inventory: The skill utilizes IAM roles with dynamodb:PutItem and ssm:GetParameter permissions, allowing external data to influence the state of the backend database or read configuration.
- Sanitization: Validation is limited to checking for the presence of specific fields (e.g., email), with no escaping or filtering of content prior to data store operations.
Audit Metadata