aws-cloudwatch
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides examples using the
awsCLI tool to query logs, metrics, and CloudTrail events. These are standard administrative operations. - [PROMPT_INJECTION]: The skill demonstrates constructing CloudWatch Insights and CloudTrail Lake queries using user-provided inputs such as log group names and query strings (e.g., in
SKILL.md). - Ingestion points:
logGroupNames,queryString,InstanceId,AlarmName,QueryStatementinSKILL.md. - Boundary markers: Absent.
- Capability inventory:
boto3client operations andawsCLI subshell executions. - Sanitization: None shown in snippets. While these represent a surface for indirect prompt injection, the behavior is consistent with the primary purpose of a monitoring utility.
- [SAFE]: No malicious obfuscation, credential theft, or unauthorized network operations were detected. All external references involve standard AWS service interactions.
Audit Metadata