Cloud Tag Enforcer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.1

Overview

The skill has a legitimate cloud-tagging purpose, but its examples include broad live-cloud remediation scripts and unsafe command patterns that users should review carefully before installing.

Install only if you are comfortable reviewing cloud-governance automation before use. Run scan/report commands with least-privileged read-only credentials where possible, do not run generated remediation scripts directly against production, replace placeholder tag values with real approved values, narrow the account/project/resource scope, and sandbox repository scans from untrusted Terraform code.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:434

Finding

Arbitrary Code Execution Through Unsafe Terraform Filename Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 434-463
Vulnerability Type: Command and Python code injection through an untrusted filename
Risk Level: High

Vulnerable Code

bash

# Find Terraform resource blocks missing tags
rg -l 'resource "aws_' . -g '*.tf' | while read tf_file; do
  python3 -c "
import re

with open('$tf_file') as f:
    content = f.read()

blocks = re.finditer(r'resource\s+\"(aws_\w+)\"\s+\"(\w+)\"\s*\{', content)
for match in blocks:
    rtype, rname = match.group(1), match.group(2)
    # Find the block end by counting braces
    start = match.end()
    depth = 1
    pos = start
    while depth > 0 and pos < len(content):
        if content[pos] == '{': depth += 1
        elif content[pos] == '}': depth -= 1
        pos += 1
    block = content[start:pos]
    if 'tags' not in block:
        print(f'MISSING tags in $tf_file: {rtype}.{rname}')
"
done

Technical Analysis

The filename returned by rg is assigned to the shell variable tf_file and then interpolated directly into the source code passed to python3 -c. The interpolation occurs inside a shell double-quoted argument and inside a Python single-quoted string:

python

with open('$tf_file') as f:

A repository controls its filenames. A crafted Terraform filename containing quote characters, line breaks, shell substitutions, or Python syntax can therefore terminate or modify the intended Python string. This allows the filename to change the Python program executed during the scan.

The loop also uses while read tf_file without null-delimited paths or IFS= read -r, making handling of backslashes, whitespace, and newline characters unsafe.

Attack Path

1. An attacker prepares a repository containing an .tf file whose contents match resource "aws_, ensuring that rg returns its filename.
2. The attacker gives the file a specially crafted name containing ...[truncated 1171 chars]

Remediation

View remediation

Remediation Suggestions

Never interpolate a repository-controlled path into shell or Python source code. Pass the filename as a positional argument and use null-delimited path handling:

bash

rg -l -0 'resource "aws_' . -g '*.tf' |
while IFS= read -r -d '' tf_file; do
  python3 - "$tf_file" <<'PY'
import re
import sys

file_path = sys.argv[1]
with open(file_path, encoding="utf-8") as f:
    content = f.read()

blocks = re.finditer(
    r'resource\s+"(aws_\w+)"\s+"(\w+)"\s*\{',
    content,
)
for match in blocks:
    rtype, rname = match.group(1), match.group(2)
    start = match.end()
    depth = 1
    pos = start

    while depth > 0 and pos < len(content):
        if content[pos] == "{":
            depth += 1
        elif content[pos] == "}":
            depth -= 1
        pos += 1

    block = content[start:pos]
    if "tags" not in block:
        print(f"MISSING tags in {file_path}: {rtype}.{rname}")
PY
done

Additional hardening should include running repository scans in a sandbox without production credentials, testing the scanner against filenames containing quotes and newlines, and avoiding source-code generation from untrusted values.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:397

Finding

Shell Injection Risk in Generated AWS Remediation Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 397-416
Vulnerability Type: Unsafe construction of executable shell commands from cloud resource identifiers
Risk Level: Medium

Vulnerable Code

python

for resource in data.get('ResourceTagMappingList', []):
    arn = resource['ResourceARN']
    tags = {t['Key']: t['Value'] for t in resource.get('Tags', [])}
    missing = {k: v for k, v in required.items() if k not in tags}

    if missing:
        tags_json = json.dumps(missing)
        commands.append(f'aws resourcegroupstaggingapi tag-resources --resource-arn-list \"{arn}\" --tags \'{tags_json}\'')

print('#!/bin/bash')
print('# Auto-generated tagging remediation script')
print(f'# {len(commands)} resources to remediate')
print('# Review before running -- placeholder values (NEEDS-*) must be replaced by owners')
print('set -euo pipefail')
print()
for i, cmd in enumerate(commands):
    print(f'echo \"[{i+1}/{len(commands)}] Tagging resource...\"')
    print(cmd)
    print('sleep 0.2  # rate limiting')
    print()

Technical Analysis

The remediation generator treats ResourceARN, obtained from the cloud API response, as trusted text and concatenates it directly into an executable shell command:

python

commands.append(
    f'aws resourcegroupstaggingapi tag-resources '
    f'--resource-arn-list \"{arn}\" --tags \'{tags_json}\''
)

Double quotes do not neutralize all shell syntax. In particular, command substitutions such as $() and backticks remain active inside double-quoted strings. If a supported cloud resource identifier can contain shell-significant characters, or if the API input is otherwise manipulated, the generated script can execute unintended commands when an operator runs it.

The generated tag values are currently fixed placeholders, which limits that specific input vector. The principal unsafe value in the documented implementation is ...[truncated 1516 chars]

Remediation

View remediation

Remediation Suggestions

Avoid generating executable shell source from cloud-derived values. Prefer a Python remediation program that invokes the AWS CLI with an argument array:

python

import json
import subprocess

subprocess.run(
    [
        "aws",
        "resourcegroupstaggingapi",
        "tag-resources",
        "--resource-arn-list",
        arn,
        "--tags",
        json.dumps(missing),
    ],
    check=True,
    shell=False,
)

If a Bash script must be generated, quote every dynamic argument with shlex.quote:

python

import json
import shlex

command = [
    "aws",
    "resourcegroupstaggingapi",
    "tag-resources",
    "--resource-arn-list",
    arn,
    "--tags",
    json.dumps(missing),
]
print(" ".join(shlex.quote(argument) for argument in command))

The remediation workflow should also validate ARNs against expected service-specific formats, write generated scripts with restrictive permissions, require explicit operator approval, and execute them in a least-privileged environment without unrelated credentials.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger list includes very broad phrases such as "missing tags," "enforce tags," and "tagging policy," which can match ordinary cloud-support conversations and cause the skill to activate unexpectedly. Because this skill can progress from auditing into generating remediation commands for live cloud environments, overbroad activation increases the chance of invoking infrastructure-changing guidance in contexts where the user did not clearly request it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill generates executable remediation scripts that tag live AWS, GCP, and potentially other cloud resources, including placeholder values like NEEDS-OWNER and CC-0000, without an upfront safety warning or mandatory approval checkpoint. In a real environment, running these scripts can mutate production infrastructure metadata at scale, corrupt governance data, interfere with billing/compliance processes, and make later attribution harder by bulk-applying incorrect tags.

Content

No source excerpt is available for this finding.