skills/mukul975/anthropic-cybersecurity-skills/performing-cloud-native-threat-hunting-with-aws-detective/Gen Agent Trust Hub
performing-cloud-native-threat-hunting-with-aws-detective
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses official AWS libraries and follows best practices for IAM-based authentication, avoiding hardcoded credentials. All network operations are directed at official AWS endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from AWS Detective and GuardDuty findings, which may contain attacker-influenced content. This ingestion surface is fundamental to the skill's purpose as a threat-hunting tool.
- Ingestion points: Investigative findings and indicators are retrieved in
scripts/process.pyandSKILL.md. - Boundary markers: Content is handled as structured API responses.
- Capability inventory: The skill permits AWS API interactions and local JSON file exports.
- Sanitization: Relies on structured data formats without custom escaping or filtering.
Audit Metadata