The Agent Skills Directory

[SAFE]: The skill provides structured procedures and code for cloud security auditing, focusing on detecting credential compromise and privilege escalation. Evidence: scripts/agent.py monitors for events like ConsoleLogin, AttachUserPolicy, and CreateAccessKey.\n- [SAFE]: The implementation relies on the official and trusted boto3 library for AWS API interactions, adhering to standard security practices. Evidence: scripts/agent.py uses boto3.Session to handle authentication securely via environment or profile settings.\n- [SAFE]: All analysis results are saved locally in a JSON report, with no identified unauthorized network communication or exfiltration of sensitive data. Evidence: The generate_report function in scripts/agent.py writes to a local filesystem path.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface that could be susceptible to indirect prompt injection if log data is manipulated by an attacker.\n
Ingestion points: AWS CloudTrail event fields (e.g., userAgent, errorMessage) fetched via boto3.lookup_events in scripts/agent.py.\n
Boundary markers: Absent in the instructions provided for the agent to analyze the log outputs.\n
Capability inventory: The skill is limited to reading logs and writing a local JSON report, with no dangerous execution or network exfiltration capabilities.\n
Sanitization: Absent; the script extracts event data using json.loads without additional content filtering for potentially malicious instructions embedded in log fields.

detecting-aws-cloudtrail-anomalies