aws-drawio-import
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (ZIP files containing SVG icons) and parses the XML content using a library known to be vulnerable to XML-based attacks.
- Ingestion points: In
scripts/build_aws_drawio_libraries.py, the script reads file content from the ZIP archive usingsource.read(info)and passes it directly toET.fromstring(svg). - Boundary markers: Absent. There are no delimiters or instructions provided to the agent or the script to ignore or sanitize embedded XML entities or instructions within the SVG data.
- Capability inventory: In
scripts/build_aws_drawio_libraries.py, the script has capabilities to write to the file system usingET.ElementTree(root).writeandPath.write_bytesto create the output XML libraries. - Sanitization: The script does not perform any validation, filtering, or sanitization of the SVG XML content before parsing, leaving it vulnerable to XXE (External Entity) and Billion Laughs (DoS) attacks.
- [COMMAND_EXECUTION]: The instructions in
SKILL.mdprompt the agent to execute shell commands using paths provided by the user. - Evidence: The instruction
python3 <SKILL_DIR>/scripts/build_aws_drawio_libraries.py <ZIPのパス> --output-dir drawio_libsrelies on the agent's ability to safely handle and escape the<ZIPのパス>variable to prevent command injection if the user provides a filename containing shell metacharacters.
Audit Metadata