The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides the Invoke command which executes code within the user's AWS environment, and UpdateFunctionCode which allows the agent to deploy new code packages from S3 or Base64-encoded zip files.
[PRIVILEGE_ESCALATION]: Several commands allow for security configuration changes that could lead to privilege escalation:
AddPermission can grant invocation rights to arbitrary principals (e.g., public SNS topics or external accounts).
CreateFunctionUrlConfig supports AuthType: NONE, which can make a Lambda function publicly accessible over the internet without authentication.
[DATA_EXFILTRATION]: The GetFunctionConfiguration command can retrieve sensitive information, as AWS Lambda environment variables are frequently used to store secrets, API keys, and connection strings.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through data ingestion points:
Ingestion points: Function outputs from Invoke, environment variables from GetFunctionConfiguration, and resource tags from ListTags or GetFunction.
Boundary markers: None provided in the tool definitions to separate data from instructions.
Capability inventory: Extensive, including code deployment (UpdateFunctionCode), execution (Invoke), and permission management (AddPermission).
Sanitization: No evidence of sanitization for the data returned from AWS APIs before it is processed by the agent.

awsflow-lambda