opensearch-skills
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill manages local development environments by executing
dockercommands viasubprocess.runto start and stop OpenSearch instances (scripts/lib/client.py). - [COMMAND_EXECUTION]: The skill manages its own UI server processes by calling
lsofandos.killto terminate existing instances on port 8765 (scripts/lib/ui.py). - [COMMAND_EXECUTION]: Instructions in
SKILL.mddirect the agent to modify system-level MCP configuration files (e.g.,.kiro/settings/mcp.json,.mcp.json) to register required servers. - [COMMAND_EXECUTION]: The quality evaluation workflow in
search/opensearch-launchpad/evaluation_guide.mdprovides Python code blocks for the agent to execute directly usinguv run python -c, enabling the calculation of search metrics. - [EXTERNAL_DOWNLOADS]: The skill can fetch sample data for indexing from user-provided URLs using
urllib.request(scripts/lib/samples.py). - [EXTERNAL_DOWNLOADS]: The Search Builder UI loads React and Babel from the
unpkg.comCDN to provide its interactive interface (scripts/ui/index.html). - [COMMAND_EXECUTION]: Indirect Prompt Injection Surface:
- Ingestion points: External URLs/files loaded via
scripts/lib/samples.pyand log/trace data queried in theobservability/category. - Boundary markers: Absent; the agent processes data from these sources to perform analysis without explicit instructions to ignore embedded commands.
- Capability inventory: Includes shell command execution, AWS infrastructure provisioning via
boto3, and direct Python execution capabilities. - Sanitization: No explicit sanitization or filtering is applied to the content of logs or sample documents before they enter the agent's context.
Audit Metadata