runbook-creation
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell scripts designed to interact with infrastructure components using
kubectl,aws-cli, andpsql. These scripts automate tasks such as scaling Kubernetes deployments, updating Route53 DNS records, and promoting database replicas during failover events. - [DATA_EXFILTRATION]: The
collect-logs.shscript gathers potentially sensitive information, including Kubernetes pod logs, CloudWatch log events, and a snapshot of active database queries (pg_stat_activity). - Evidence: The script aggregates this data into a temporary directory (
/tmp/incident-...) and creates a compressed tarball. - Mitigation: The script follows security best practices by implementing
umask 077to restrict access to the collected data to the current user and uses regex validation to sanitize the user-provided incident ID, preventing command injection.
Audit Metadata