cloud-aws
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/cost.pyutility uses the Pythonsubprocessmodule to execute AWS CLI commands for data retrieval. These commands (e.g.,aws s3api,aws cloudwatch) are used to gather infrastructure metadata for cost estimation. The implementation uses list-based arguments withsubprocess.run, which prevents shell injection by avoiding the use of a system shell for command execution. - [SAFE]: The instructions in
SKILL.mdpromote security best practices, such as using IAM roles with least privilege, avoiding hardcoded credentials, and using AWS Secrets Manager for sensitive data management. - [SAFE]: Analysis of the Python scripts and project configuration found no evidence of obfuscation, remote code downloads, unauthorized data exfiltration, or persistence mechanisms.
Audit Metadata