The Agent Skills Directory

[Command Execution]: The skill uses shell commands like zip, aws cli, and openssl to prepare and upload workspace data. These operations are restricted to the local workspace and the user's AWS account environment.
[Data Handling]: Workspace source code and design documents are archived and uploaded to an AWS S3 bucket for analysis. This is a necessary step for the AWS Security Agent service to perform threat modeling, and the skill dynamically resolves the target bucket based on the user's active AWS account and region to maintain isolation.
[Indirect Prompt Injection]: The skill ingests external design documents (requirements.md, design.md) which are processed by the threat modeling service. While this represents a common attack surface for AI-integrated tools, the risk is inherent to the intended functionality of reviewing user-provided documentation for security risks.
[Secure Defaults]: The workspace archiving process explicitly excludes sensitive directories such as .git, .venv, and .security-agent/ (which may contain local configuration), reducing the risk of accidental exposure of credentials or metadata during the analysis process.

threat-modeling-with-aws-security-agent