Ri Savings Advisor

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only AWS cost analysis skill that asks for exported read-only billing and reservation data, with no code or direct account access shown.

Before using it, make sure any AWS data you paste is an export from read-only billing/reservation commands and does not include credentials, access keys, secret keys, or session tokens.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If you run the suggested commands, the resulting exports may reveal AWS spending, service usage, and reservation inventory.

Why it was flagged

The skill asks the user to run read-only AWS billing and reservation queries locally. This is purpose-aligned, but it involves AWS account permissions and sensitive cost/usage visibility.

Skill content

"Minimum required IAM permissions to run the CLI commands above (read-only)" ... "Action": ["ce:GetCostAndUsage", "ce:GetSavingsPlansUtilization", "ce:GetReservationUtilization", "ec2:DescribeReservedInstances"], "Resource": "*"

Recommendation

Use a least-privilege read-only IAM role or profile, review exports for secrets before sharing, and avoid pasting access keys or session tokens.