skills/mukul975/anthropic-cybersecurity-skills/performing-cloud-forensics-with-aws-cloudtrail/Gen Agent Trust Hub
performing-cloud-forensics-with-aws-cloudtrail
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external AWS CloudTrail logs which can contain attacker-controlled strings.
- Ingestion points: The scripts/agent.py file retrieves log data using the boto3 library, including fields such as userAgent, sourceIPAddress, requestParameters, and responseElements.
- Boundary markers: The script produces a JSON report that lacks delimiters or specialized instructions to prevent an agent from interpreting log content as executable instructions.
- Capability inventory: The script performs local file writes and direct output of raw log content to the agent's context.
- Sanitization: No filtering or sanitization is applied to the raw log fields before they are included in the generated forensic report.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the official AWS SDK for Python.
- Evidence: The scripts/agent.py file imports the boto3 package, which is an official and trusted library from Amazon Web Services.
Audit Metadata