The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents a significant surface for indirect prompt injection because it reads and processes untrusted data from multiple AWS services which could be influenced by external actors (e.g., CloudWatch logs, S3 bucket contents, Glue job outputs, and API Gateway execution logs).
Ingestion points: Data enters the context via ReadFile, ReadFileStream, ListFiles, and various AWS-specific tools mentioned in the Cross-Service Discovery Guide (e.g., CloudWatchLogTool, EC2Tool, LambdaTool).
Boundary markers: The documentation mentions that mutating operations require user confirmation, but does not explicitly detail prompt-level boundary markers for data ingestion.
Capability inventory: The skill possesses high-privilege capabilities including file system write/append (WriteFile, AppendFile), archive creation (ZipTextFile), and session/credential management (SetSession, RefreshCredentials).
Sanitization: No specific sanitization or filtering of external AWS content is documented.
[COMMAND_EXECUTION]: The FileOperationsTool allows for extensive interaction with the local file system, including reading, writing, and directory listing. While these are intended features, they provide a vector for arbitrary file manipulation if the agent is misled by malicious input.
[DATA_EXFILTRATION]: The skill provides tools to read sensitive local configuration files such as ~/.aws/credentials and ~/.aws/config through the SessionTool and FileOperationsTool. While the skill documentation states credentials are not sent to AI services, the capability to read these files and then use other tools (like AWS SDK operations or future network-enabled tools) creates a potential path for exfiltration if the agent behavior is compromised.

awsflow-general