performing-cloud-asset-inventory-with-cartography

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/agent.py utilizes the subprocess.run method to execute the cartography command-line utility. This is a standard wrapper pattern to invoke the tool for asset synchronization using parameters provided via the script's own CLI.
  • [PERSISTENCE]: The SKILL.md file provides instructions for configuring a cron job to automate regular cloud asset synchronization. This use of a persistence mechanism is a legitimate and standard method for maintaining up-to-date security inventory data.
  • [EXTERNAL_DOWNLOADS]: The skill directs users to install the cartography and neo4j packages from the official Python Package Index (PyPI) and uses standard Neo4j Docker images. These resources are from well-known and reputable sources consistent with the skill's purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes structured metadata from cloud environments via the Cartography sync process and subsequent graph queries.
  • Ingestion points: Infrastructure metadata is fetched from Cloud APIs (AWS, GCP, Azure) and stored in a Neo4j database.
  • Boundary markers: Interaction with the data is performed through hardcoded and structured Cypher queries within the scripts/agent.py and scripts/process.py files.
  • Capability inventory: The skill has the ability to execute the cartography tool and write report files to the local disk.
  • Sanitization: The results are handled as structured data records by the Neo4j driver and the Python scripts, minimizing risks associated with untrusted data processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:33 AM