update-chrome-binaries-test-region
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands to manage the AWS environment and local build processes.
- Runs
aws sts get-caller-identityto verify the active AWS account (678892195805). - Uses
eval "$(aws configure export-credentials --format env)"to bridge AWS SSO/Identity Center credentials into the environment for the Lambda client. - Executes local scripts and tools including
bun src/admin/make-layer-public.ts,curl -sI, and./run.sh(Docker tests). - [EXTERNAL_DOWNLOADS]: Fetches Chrome version metadata from a well-known service (Google's Chrome for Testing repository on GitHub Pages).
- Targets
https://googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external JSON source which could theoretically be manipulated to influence the version strings used in the build.
- Ingestion points:
SKILL.md(via reference to the Google Chrome for Testing JSON metadata). - Boundary markers: Not explicitly defined for the external data ingestion.
- Capability inventory: Includes shell command execution, AWS Lambda layer publication, and file system writes.
- Sanitization: The skill includes a manual verification step using
curl -sIto ensure the binaries exist before the agent proceeds with updates, providing a check against invalid or malicious data. - [SAFE]: The resources and scripts referenced (e.g.,
packages/lambda,remotion.media) are internal to the vendor's repository structure and infrastructure, representing legitimate administrative functionality.
Audit Metadata