The Agent Skills Directory

[DATA_EXFILTRATION]: The skill directs the agent to search for AWS environment information within potentially sensitive project files.
Instructions in references/aws-iam-policy-generation.md (Task 1b) mandate checking .env, terraform.tfvars, cdk.json, cdk.context.json, and samconfig.toml for account IDs and regions. Accessing these files, which are standard locations for storing secrets, poses a significant data exposure risk.
[REMOTE_CODE_EXECUTION]: The skill uses uvx to download and execute an external tool for analyzing source code at runtime.
Executes uvx iam-policy-autopilot@latest generate-policies to derive IAM policies from application code. The tool is maintained by the awslabs organization on GitHub, an official repository for Amazon Web Services.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to interact with the environment and development tools.
Runs aws sts get-caller-identity to retrieve current account details.
Executes the iam-policy-autopilot CLI to generate permissions.
[EXTERNAL_DOWNLOADS]: The skill fetches official AWS service definitions from a remote endpoint.
Queries https://servicereference.us-east-1.amazonaws.com to map API operations to the correct IAM actions.
[PROMPT_INJECTION]: The skill ingests untrusted application source code to automate policy generation, creating a surface for indirect prompt injection.
Ingestion points: Analyzes source code files in Python, Go, TypeScript, and Java provided by the user in references/aws-iam-policy-generation.md.
Boundary markers: No specific delimiters or safety instructions are defined for the source code content being processed.
Capability inventory: The skill has access to shell execution (aws, uvx) and network operations (curl).
Sanitization: Risk is mitigated by the use of the iam-policy-autopilot tool, which performs deterministic static analysis rather than relying on LLM reasoning to interpret the code, reducing the likelihood of malicious instructions influencing the output.

aws-iam