hf-cloud-aws-context-discovery
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard AWS CLI commands to retrieve local configuration metadata.
- Evidence: Uses
aws configure list-profiles,aws configure list, andaws configure get regionto identify active profiles and regions. - Evidence: Uses
aws sts get-caller-identityto validate credentials and retrieve the active principal. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses AWS Account IDs and Caller ARNs to establish working context.
- Context: This is the intended primary purpose of the discovery skill. It follows security best practices by explicitly instructing the agent never to open or print
~/.aws/credentials, environment variables containing secrets, access keys, or session tokens. - Mitigation: It recommends using masked CLI metadata commands instead of parsing raw credential files.
Audit Metadata