awsflow-emr
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from EMR clusters which can serve as a vector for malicious instructions.
- Ingestion points: The agent retrieves untrusted data from the EMR environment via commands such as
ListClusters,DescribeCluster,ListSteps, andListNotebookExecutions, which return user-defined names, step definitions, and execution details. - Boundary markers: There are no explicit boundary markers or instructions to treat data retrieved from EMR APIs as untrusted or to ignore instructions embedded within that data.
- Capability inventory: The skill has significant capabilities, including cluster creation (
RunJobFlow), termination (TerminateJobFlows), code execution on the cluster (AddJobFlowSteps), and credential retrieval (GetClusterSessionCredentials). - Sanitization: The skill does not provide any mechanisms for sanitizing or filtering instructions from EMR metadata before it enters the agent's context.
- [COMMAND_EXECUTION]: The
AddJobFlowStepscommand enables the execution of arbitrary code, such as Spark or Hadoop JARs and scripts (e.g.,s3://bucket/job.py), on the managed EMR cluster. This provides a powerful execution environment that could be exploited if the agent is influenced by malicious input. - [DATA_EXFILTRATION]: The skill provides the
GetClusterSessionCredentialscommand, which allows the retrieval of session credentials for EMR clusters. Access to these credentials represents a sensitive data exposure point within the administrative lifecycle.
Audit Metadata