The Agent Skills Directory

[SAFE]: The skill demonstrates exceptional security practices for an AI agent extension.
[COMMAND_EXECUTION]: The provided Python script executes AWS Bedrock API calls via the official boto3 SDK. It includes secure file handling using os.open with O_EXCL and 0o600 permissions to prevent race conditions and unauthorized file access when managing local job state.
[CREDENTIALS_SAFE]: Sensitive data such as AWS Account IDs, project identifiers, and approval tokens are handled exclusively through environment variables (os.environ.get). There are no hardcoded secrets or credentials.
[DATA_EXFILTRATION]: The script implements strict validation of S3 output URIs using urllib.parse.urlparse to prevent directory traversal (..) and ensures that data is only written to an approved prefix defined in NOVA_ALLOWED_OUTPUT_PREFIX.
[PROMPT_INJECTION]: The skill provides guidance on visual prompting (e.g., camera moves, subject identity) without attempting to bypass safety filters. It explicitly acknowledges and defers to AWS Bedrock's built-in abuse detection and safety watermarking features.
[INDIRECT_PROMPT_INJECTION]: The skill follows a 'fail-closed' design pattern. It requires a SHA-256 digest match (APPROVED_SHA256) of the entire request payload before execution, ensuring that the agent cannot be tricked into modifying the request (e.g., changing the destination bucket or prompt) after a human has approved the cost and content.

amazon-nova-reel