The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/agent.py and scripts/process.py utilize subprocess.run to execute the scout command-line utility. The commands are constructed using a list of arguments, which is a safe practice to prevent shell injection, and the execution is limited to the intended security tool functionality.\n- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the scoutsuite and boto3 packages via pip. These are well-known, legitimate tools for AWS security auditing and interaction from recognized sources.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON output files generated by ScoutSuite to extract security findings. As this data originates from the environment being audited, it represents a potential surface where malicious resource names in the target cloud could be reflected in the agent's report.\n
Ingestion points: scripts/agent.py (via parse_results) and scripts/process.py (via parse_scoutsuite_results) ingest external report files.\n
Boundary markers: None identified in the report parsing logic.\n
Capability inventory: Subprocess execution for the scout CLI is present in both scripts.\n
Sanitization: The scripts do not explicitly sanitize findings descriptions or rationales extracted from the results before reporting them.

performing-aws-account-enumeration-with-scout-suite