aws-infrastructure
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest system topology and requirements from an external file (
system-design-spec.json) to provision AWS infrastructure. While this constitutes a data ingestion surface where instructions could theoretically be embedded, the skill mandates robust validation steps including IAM Access Analyzer, CIS benchmarks, and security audits. - [DYNAMIC_EXECUTION]: The skill utilizes Crossplane Compositions with compiled Go functions (
function-go-templating) or KCL for resource provisioning. These tools are used for standard Infrastructure-as-Code (IaC) templating and configuration generation rather than arbitrary runtime code execution. - [COMMAND_EXECUTION]: The skill allows for the
execute_commandtool, which is intended for infrastructure provisioning and validation tasks (e.g., running OpenTofu/Terraform or Crossplane). The instructions explicitly prohibit the use of general-purpose shells on worker nodes through the enforcement of AWS Bottlerocket distroless images.
Audit Metadata