The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py uses subprocess.run() to execute AWS CLI commands. While it correctly uses an argument list to mitigate shell injection, the skill's functionality depends on the presence and credentials of the AWS CLI tool in the execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from CloudTrail logs which may contain adversarial content.
Ingestion points: scripts/agent.py retrieves log entries via aws cloudtrail lookup-events, capturing fields like userAgent, Username, and object key names.
Boundary markers: The script does not apply any delimiters or instructional warnings to the JSON output intended for AI processing, increasing the risk that the agent may interpret data fields as commands.
Capability inventory: The skill possesses the capability to execute AWS CLI commands, including potentially destructive ones like s3api put-bucket-policy (defined in block_external_access).
Sanitization: String fields are truncated to fixed lengths (e.g., 100 characters for keys), but no filtering, escaping, or validation is performed on the content to remove potential prompt injection payloads.

detecting-s3-data-exfiltration-attempts