detecting-cryptomining-in-cloud
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements industry-standard cloud security practices, utilizing official services like GuardDuty and AWS Cost Explorer. All workflows are focused on identifying and mitigating resource hijacking.
- [COMMAND_EXECUTION]: In
scripts/agent.py, the skill executes AWS CLI commands viasubprocess.runwith list-based arguments. This approach is secure and avoids shell-injection vulnerabilities by not using theshell=Trueparameter and passing arguments as an array. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external log data, creating a potential surface for indirect prompt injection. However, this is managed by the skill's specific use-case and secure coding practices.
- Ingestion points: GuardDuty findings, CloudTrail logs, and VPC Flow Logs in
scripts/agent.py. - Boundary markers: None identified.
- Capability inventory: The skill has the capability to modify infrastructure (security groups, instance attributes) via
scripts/agent.pyfor isolation purposes. - Sanitization: The script uses structured data handling via
json.loadsand secure argument passing to mitigate exploitation risk.
Audit Metadata