querying-data-lake
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- SQL Statement Classification and Guardrails: The skill implements a robust classification system that distinguishes between 'Safe' analytical queries (e.g., SELECT) and 'Destructive' administrative operations (e.g., DROP, DELETE, TRUNCATE). It mandates explicit user confirmation before executing any destructive command, which is an effective safeguard against accidental data loss.
- Environment and Identity Verification: The skill utilizes AWS identity tools like
sts get-caller-identityto resolve the execution context before performing operations. This ensures that workgroup selection and data access are appropriate for the user's IAM role, reducing the risk of permission errors or unauthorized access. - Data Management and Cost Awareness: Instructions include verifying S3 output locations and informing the user of the data scanned and associated costs. These steps promote responsible resource usage and ensure that query results are stored in expected, governed locations.
- Controlled Command Execution: Interaction with AWS services is performed through official tools (AWS MCP server and AWS CLI). The skill maintains clear boundaries by requiring these tools to be explicitly called, allowing for proper audit logging and credential management.
Audit Metadata