opensearch-skills

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill manages local development environments by executing docker commands via subprocess.run to start and stop OpenSearch instances (scripts/lib/client.py).
  • [COMMAND_EXECUTION]: The skill manages its own UI server processes by calling lsof and os.kill to terminate existing instances on port 8765 (scripts/lib/ui.py).
  • [COMMAND_EXECUTION]: Instructions in SKILL.md direct the agent to modify system-level MCP configuration files (e.g., .kiro/settings/mcp.json, .mcp.json) to register required servers.
  • [COMMAND_EXECUTION]: The quality evaluation workflow in search/opensearch-launchpad/evaluation_guide.md provides Python code blocks for the agent to execute directly using uv run python -c, enabling the calculation of search metrics.
  • [EXTERNAL_DOWNLOADS]: The skill can fetch sample data for indexing from user-provided URLs using urllib.request (scripts/lib/samples.py).
  • [EXTERNAL_DOWNLOADS]: The Search Builder UI loads React and Babel from the unpkg.com CDN to provide its interactive interface (scripts/ui/index.html).
  • [COMMAND_EXECUTION]: Indirect Prompt Injection Surface:
  • Ingestion points: External URLs/files loaded via scripts/lib/samples.py and log/trace data queried in the observability/ category.
  • Boundary markers: Absent; the agent processes data from these sources to perform analysis without explicit instructions to ignore embedded commands.
  • Capability inventory: Includes shell command execution, AWS infrastructure provisioning via boto3, and direct Python execution capabilities.
  • Sanitization: No explicit sanitization or filtering is applied to the content of logs or sample documents before they enter the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 10:09 PM
Security Audit — agent-trust-hub — opensearch-skills