finding-data-lake-assets
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes customer-authored 'catalog context' from the Glue Data Catalog, which acts as a vector for untrusted data ingestion. The skill includes specific instructions to mitigate this by treating content as data and ignoring embedded commands.
- Ingestion points: Data is retrieved via
SearchAssetsandGetAssetoperations inSKILL.md. - Boundary markers: Explicit instructions are provided to ignore directives like 'ignore previous instructions' or 'run' within the catalog text.
- Capability inventory: The skill possesses the ability to execute AWS CLI commands and run local Python scripts.
- Sanitization: The agent is instructed to shell-quote all user-provided values and validate that identifiers match specific ARN patterns before use.
- Dynamic Script Execution: The skill dynamically generates a Python script using the 'boto3' library to perform cross-database catalog scans. This script is written to a local file and executed using
python3. While the script follows a fixed template, the generation and execution of code at runtime is a dynamic execution pattern that expands the agent's capabilities. - System Command Execution: The skill performs various shell-based operations using AWS tools for search and verification tasks. It proactively identifies potential command injection risks by requiring the agent to shell-quote all inputs when constructing these CLI commands.
Audit Metadata