aws-sst-development
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides structured guidance for using the SST v4 framework, incorporating security-conscious practices such as verifying AWS identity with
aws sts get-caller-identitybefore deployment and cautioning the user to clean up state files that may contain sensitive account details. - [COMMAND_EXECUTION]: The skill documents the use of industry-standard CLI tools including
npx sst,npx vitest, and theawsCLI. These tools are appropriate and necessary for the skill's stated purpose of managing infrastructure as code. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze project-specific files such as
sst.config.tsand resources in theinfra/directory. While this represents a surface for indirect prompt injection if those files were to contain malicious instructions, this behavior is fundamental to the skill's function as a code expert and contains no specific exploitable patterns. - [DYNAMIC_EXECUTION]: The skill operates within the SST/Pulumi ecosystem, which inherently uses dynamic execution of TypeScript to generate and apply infrastructure plans. This is the intended behavior of the framework being documented.
Audit Metadata