opensearch-launchpad
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive AWS credential and configuration files located at
~/.aws/credentialsand~/.aws/configto interact with Amazon OpenSearch Service and Amazon Bedrock. - [COMMAND_EXECUTION]: The workflow relies on executing local shell scripts (
scripts/start_opensearch.sh) and invoking Python scripts (scripts/opensearch_ops.py) using theuvtool to manage OpenSearch operations. - [DYNAMIC_EXECUTION]: The search quality evaluation guide uses
uv run python -cto execute dynamically constructed Python code blocks for calculating relevance metrics. - [EXTERNAL_DOWNLOADS]: The skill can fetch sample data from external sources, specifically citing the IMDb public dataset export, when the
--allow-downloadflag is used during data collection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data from local files, documents (PDF, DOCX), and external URLs. This ingestion surface, combined with the skill's capabilities for network access and script execution, allows for embedded instructions to influence agent behavior. 1. Ingestion points: Phase 1 data collection from local files, URLs, and documents. 2. Boundary markers: None identified. 3. Capability inventory: Local script execution, network access to AWS/OpenSearch APIs, and file system access. 4. Sanitization: No explicit sanitization or validation of the processed content is documented.
Audit Metadata