diff-scanning-with-aws-security-agent
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands including
git diff,zip, andawsCLI commands to process code and manage scan jobs. These are standard operations for the skill's intended purpose and run within the user's local environment. - [DATA_EXFILTRATION]: Workspace source code is zipped and uploaded to an S3 bucket. The destination bucket name
security-agent-scans-<account>-<region>is constructed using the user's own AWS account identity (retrieved viaaws sts get-caller-identity), ensuring that the data remains within the user's own AWS environment. - [COMMAND_EXECUTION]: User-provided input (
BASE_REF) is interpolated into a shell command (git diff "$BASE_REF..HEAD"). While this creates a potential injection surface if the input is malicious, the operations are limited to the user's local repository context and are necessary for the tool's functionality.
Audit Metadata