Security audit
Security checks for vulnerabilities and agentic risk
This SES helper skill uses AWS credentials and can send email or create SES identities, but those capabilities are disclosed, scoped, and user-controlled.
Install only if you want an agent to help administer AWS SES. Use least-privilege IAM credentials, preview mutating actions with the provided dry-run flags, keep SMTP/API secrets out of chat and logs, and require explicit confirmation before sending email or calling any Sendy endpoint.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Credentials — never commit or package
.env
.env.*
*.env
.aws/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Credentials — never commit or package
.env
.env.*
*.env
.aws/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Credentials — never commit or package
.env
.env.*
*.env
.aws/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Credentials — never commit or package
.env
.env.*
*.env
.aws/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def test_dig_short_rejects_invalid_names(self):
with mock.patch("subprocess.run") as run:
for bad in ["-f/etc/passwd", "a b.com", "x.com;rm", "@8.8.8.8", ""]:
with self.assertRaises(ValueError):
verify_dns.dig_short(bad)
run.assert_not_called()
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
the user asks, and do not paste the result into chat or logs.
- Ask before anything that sends mail, mutates AWS resources, or calls a
third-party URL (Sendy, `curl` examples in `SKILL.md`).
- Do not read other skills' directories or create cron jobs, startup hooks, or
state files.
- Preview mutating steps with `--dry-run` (`send_test_email.py`, `setup_domain.py`).
- Tests must stay mocked (`python3 -m unittest tests.test_aws_ses -v`). Do not
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
the user asks, and do not paste the result into chat or logs.
- Ask before anything that sends mail, mutates AWS resources, or calls a
third-party URL (Sendy, `curl` examples in `SKILL.md`).
- Do not read other skills' directories or create cron jobs, startup hooks, or
state files.
- Preview mutating steps with `--dry-run` (`send_test_email.py`, `setup_domain.py`).
- Tests must stay mocked (`python3 -m unittest tests.test_aws_ses -v`). Do not
The skill documents capabilities that involve shell execution, environment-variable access, and writing files, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent may infer broader authority than intended and execute sensitive operations like AWS API calls, file writes, or email sending without clear policy constraints.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
On EC2/ECS/Lambda, attach an IAM role instead and set only the region.
If you must use a `.env` file, keep it **outside** any git repo and outside the
installed skill directory, and `chmod 600` it. This repo's `.gitignore` and
`.skillignore` exclude `.env*`, `*.pem` and `credentials` files as a backstop.
### Region choice
The documented curl examples transmit data, including an API key and campaign/subscriber parameters, to an external HTTP endpoint. Even though the text warns that the user should run these commands and that agents must ask first, an agent consuming this skill could still exfiltrate secrets or trigger real outbound email/subscriber actions if execution safeguards are absent.
curl -X POST "$SENDY_URL/api/campaigns/create.php" \
--data-urlencode "api_key=$SENDY_API_KEY" \
-d "brand_id=1" \
-d "list_ids=1,2" \
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
raise ValueError(f"unsupported record type: {record_type!r}")
try:
# -q/-t pin each value to its role so a name can never be read as a dig option.
proc = subprocess.run(
["dig", "+short", "-q", name, "-t", record_type],
capture_output=True,
text=True,
No suspicious patterns detected.