skills/mukul975/anthropic-cybersecurity-skills/detecting-aws-guardduty-findings-automation/Gen Agent Trust Hub
detecting-aws-guardduty-findings-automation
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill's metadata contains inconsistent author information. The YAML frontmatter lists 'mahipal' as the author, while the LICENSE file and system context identify 'mukul975'.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes AWS GuardDuty findings, which are derived from external untrusted sources like network logs and audit events.\n
- Ingestion points: Findings are fetched via boto3 in scripts/agent.py and scripts/process.py, and received via EventBridge in the provided Lambda examples.\n
- Boundary markers: The skill does not employ explicit boundary markers or instructions to the agent to ignore potentially malicious content embedded in finding fields.\n
- Capability inventory: The skill includes functions to modify EC2 security groups, create volume snapshots, and update IAM user policies.\n
- Sanitization: There is no evidence of sanitization or validation of finding data before it is processed by the agent or automation scripts.
Audit Metadata