awsflow-s3-fileops
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by downloading untrusted content from remote S3 buckets.
- Ingestion points: Untrusted data enters the agent context through the
DownloadFileandDownloadFoldercommands, which fetch objects from S3 keys and prefixes. - Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from interpreting or executing commands that might be embedded within the downloaded files.
- Capability inventory: The skill possesses capabilities for reading and writing to the local file system, as well as performing network-based S3 operations across different commands.
- Sanitization: The skill does not implement any visible sanitization or validation of the content retrieved from external S3 sources before the agent processes it.
- [DATA_EXFILTRATION]: The
UploadFileandUploadFoldertools allow for the transfer of local data to external storage. While this is the intended functionality, it provides a vector for exfiltrating sensitive local files (such as credentials, configuration, or personal data) to a remote, potentially attacker-controlled S3 bucket if the agent is misled by a malicious prompt.
Audit Metadata