aws-sdk-java-v2-bedrock
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
WeatherTool.javacomponent (located in the references directory) fetches real-time weather data from theapi.open-meteo.comservice, which is a well-known public weather API. - [SAFE]: The skill follows security best practices by utilizing official AWS SDK for Java 2.x libraries and recommending IAM-based authentication (
ProfileCredentialsProvider,DefaultCredentialsProvider) rather than hardcoded credentials. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates a tool-use pattern where the agent processes data from an external API. The instructions explicitly warn developers to sanitize user inputs to prevent injection attacks and the provided Java code includes basic sanitization (removing quotes) for the API parameters.
- [SAFE]: Documentation files in the
references/directory include standard HTML redirect scripts and metadata common to exported AWS SDK documentation. These components are benign in the context of an agent skill providing developer examples.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata