aws-secrets-manager
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill provides a wrapper script,
asm-exec, which resolves dynamic references and executes a target command with those secrets. This allows secret values to be passed to child processes via environment variables or arguments without exposing them to the agent. This behavior is the primary intended function of the skill. - Dynamic Reference Resolution: The script resolves
{{resolve:secretsmanager:...}}tags by communicating with a local Secrets Manager Agent (SMA) or a vendor-controlled MCP endpoint. This resolution process uses single-pass substitution to mitigate risks where a secret value might contain instructions that could trigger recursive resolution. - Credential Handling: To authenticate with the MCP endpoint, the script gathers AWS credentials from standard locations like environment variables and the AWS CLI. This is a routine operation for tools interacting with AWS services.
- Indirect Prompt Injection Surface: Because the skill processes dynamic references and interpolates them into commands, it naturally possesses an indirect prompt injection surface. The implementation includes measures, such as shell quoting for secret identifiers and single-pass regex substitution, to manage the risks associated with processing this external data.
Audit Metadata