s3-upload
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data (object keys and metadata) from external S3-compatible storage.
- Ingestion points: The
list,find, andheadcommands inscripts/s3-cli.jsretrieve object keys and metadata from remote S3-compatible servers and output them to the agent. - Boundary markers: Although the CLI provides structured JSON output (via the
--jsonflag) which helps delineate data, it lacks explicit boundary markers or instructions to the agent to disregard instructions embedded within the retrieved object metadata. - Capability inventory: The skill possesses significant capabilities, including writing files to the local system (
download), deleting remote objects (delete), and making network requests to arbitrary S3-compatible endpoints defined in environment variables. - Sanitization: The script does not perform sanitization or validation of object keys or metadata before presenting them to the agent, allowing potentially malicious strings to enter the agent's context.
Audit Metadata