assume-cloudformation-role
Warn
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE] (MEDIUM): The skill creates a temporary file
/tmp/creds.jsoncontaining sensitive AWS session credentials (AccessKeyId, SecretAccessKey, and SessionToken). Since/tmpis frequently world-readable on many operating systems, these credentials could be exposed to other local users or malicious processes before the file is deleted. - [COMMAND_EXECUTION] (LOW): Input parameters such as
role_arnandprofileare directly interpolated into shell commands (aws sts assume-role). This presents a potential surface for shell injection if the AI agent does not properly sanitize these inputs to prevent the execution of arbitrary commands.
Audit Metadata