The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the AWS CLI to perform infrastructure operations.
Evidence: Commands such as aws ec2 run-instances, aws ec2 create-key-pair, and aws autoscaling create-auto-scaling-group are used throughout SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill fetches an external installation script from a well-known service domain.
Evidence: The userdata.sh snippet in SKILL.md uses wget to download an installer from https://aws-codedeploy-us-east-1.s3.us-east-1.amazonaws.com/latest/install.
[REMOTE_CODE_EXECUTION]: The skill executes a downloaded script as part of the instance bootstrapping process.
Evidence: In SKILL.md, the userdata.sh script downloads the CodeDeploy agent and immediately executes it using ./install auto.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data that could contain malicious instructions.
Ingestion points: The skill uses aws ec2 get-console-output and aws ec2 describe-instances which read potentially attacker-influenced data (like console logs or resource tags) into the agent's context.
Boundary markers: No explicit delimiters or warnings are provided to the agent to treat this external output as untrusted.
Capability inventory: The skill includes high-privilege commands for modifying infrastructure, such as modify-instance-attribute and stop-instances.
Sanitization: There is no evidence of sanitization or filtering of the data retrieved from the AWS API before it is presented to the agent.

aws-ec2