awsflow-s3
Warn
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from S3 objects, creating a surface for indirect instructions to influence agent behavior.
- Ingestion points: The
GetObjectcommand (withAsText: true) andSelectObjectContentread external data into the agent context (SKILL.md). - Boundary markers: Absent. The skill lacks delimiters or instructions to treat object data as untrusted content.
- Capability inventory: The agent has extensive permissions including
PutObject,DeleteObject,PutBucketPolicy, andDeleteBucketPolicy(SKILL.md). - Sanitization: Absent. There is no validation or filtering of content retrieved from S3.- [PRIVILEGE_ESCALATION]: The
PutBucketPolicyandDeleteBucketPolicycommands allow the agent to modify or remove security constraints on S3 buckets, which could lead to unauthorized access or public data exposure.- [DATA_EXFILTRATION]: TheGetObjectcommand facilitates the reading of object content (AsText) or downloading to temporary storage (DownloadToTemp), providing a path for sensitive data to be extracted from secure storage.
Audit Metadata