aws-cli
Warn
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides specific examples for downloading sensitive configuration files from S3 buckets, such as
aws s3 cp s3://contoso-prod-backup/config.env ./config.env. Accessing.envfiles is a high-risk activity as they frequently contain secrets or sensitive environment variables. - [CREDENTIALS_UNSAFE]: The skill includes instructions to retrieve plaintext credential values from AWS Secrets Manager using the
get-secret-valuecommand, which allows the agent to harvest database passwords and other sensitive information. - [COMMAND_EXECUTION]: The skill relies on the execution of shell commands via the AWS CLI. While this is the intended purpose of the skill, it provides the agent with a powerful interface to interact with cloud infrastructure.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection via data ingested from the AWS environment.
- Ingestion points: AWS S3 bucket names, object keys, IAM policy descriptions, and secret metadata (SKILL.md).
- Boundary markers: Absent; there are no instructions to treat the output of AWS CLI commands as untrusted or to ignore embedded instructions within resource metadata.
- Capability inventory: The skill allows for broad read access to S3, IAM, EC2, and Secrets Manager via the AWS CLI.
- Sanitization: Absent; data returned from AWS APIs is processed and displayed without validation or escaping.
Audit Metadata