AWS Patrol

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.1

Overview

This AWS reporting skill is purpose-aligned, but it handles sensitive cloud data and uses an unsafe report-rendering workflow that needs manual review before installation.

Install only with a least-privilege read-only AWS profile, a dedicated output directory with restrictive permissions, and reviewed chat destinations. Avoid the documented http.server plus --no-sandbox screenshot command until the report generator escapes all data, serves only a dedicated report directory on loopback, and runs Chromium with appropriate isolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gen-report.py:14

Finding

Unescaped Report Data Allows HTML and Content Injection

Content

View full analysis

1 else {} def r(key, default='—'): return str(data.get(key, default)) replacements = { '{{DATE}}': r('date', '2026-04-08'), '{{WEEKDAY}}': r('weekday', '周三'), '{{TIME}}': r('time', '09:00'), '{{EC2_COUNT}}': r('ec2Count', '86'), '{{RDS_COUNT}}': r('rdsCount', '34'), '{{ELB_COUNT}}': r('elbCount', '28'), '{{COST_TOTAL}}': r('costTotal', '70,005'), '{{COST_DAILY}}': r('costDaily', '2,334'), '{{UNATTACHED_VOL}}': r('unattachedVol', '19'), '{{UNUSED_EIP}}': r('unusedEip', '1'), '{{LOW_CPU}}': r('lowCpu', '53'), '{{OLD_SNAP}}': r('oldSnap', '1'), '{{SP_UTIL_PCT}}': r('spUtilPct', '100'), '{{SP_COV_PCT}}': r('spCovPct', '51.5'), '{{RDS_RI_PCT}}': r('rdsRiPct', '34.6'), '{{EC_RI_PCT}}': r('ecRiPct', '18.4'), '{{NO_MFA}}': r('noMfa', '31/35'), '{{UNENC_EBS}}': r('unencEbs', '201/205'), '{{OPEN_SG}}': r('openSg', '17'), '{{OLD_KEYS}}': r('oldKeys', '13'), '{{S3_RISK}}': r('s3Risk', '4/19'), } for k, v in replacements.items(): html = html.replace(k, v) high_cpu = data.get('highCpu', [ {'name': 'kafka-prod-server-02', 'cpu': 50.6, 'level': 'orange'}, ]) cpu_html = '' for item in high_cpu: level = item.get('level', 'yellow') cpu_html += f'

{item["name"]}{item["cpu"]}%

' html = html.replace('{{HIGH_CPU_ITEMS}}', cpu_html) sp_details = data.get( 'spRiDetails', 'SP: $27.06/h 承诺 (3个活跃) · RDS RI: 31个实例 · Redis RI: 60个节点' ) html = html.replace('{{SP_RI_DE ...[truncated 3945 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:76

Finding

Chromium Security Sandbox Is Explicitly Disabled During Report Rendering

Content

View full analysis

{const b=await p.launch({headless:'new',args:['--no-sandbox']});const pg=await b.newPage();await pg.setViewport({width:520,height:800,deviceScaleFactor:2});await pg.goto('http://localhost:18923/daily-report.html',{waitUntil:'networkidle0'});await pg.screenshot({path:'daily-report.png',fullPage:true});await b.close()})()" ``` ### Technical Analysis The documented Puppeteer command passes Chromium the `--no-sandbox` option. Chromium's process sandbox is a major defense-in-depth boundary intended to limit the operating-system access available to compromised renderer processes. Disabling the sandbox is not inherently necessary for screenshot generation. It is particularly hazardous in this project because the rendered document is built using unescaped data. Consequently, a report may contain attacker-controlled markup or external resources. HTML injection alone does not automatically create arbitrary operating-system code execution. However, if malicious content triggers a Chromium vulnerability, disabling the sandbox can eliminate a containment layer that would otherwise restrict the renderer. ### Attack Path 1. An attacker introduces malicious content into a field included in the generated report. 2. `gen-report.py` writes the content into `daily-report.html` without safe escaping. 3. The documented Puppeteer command opens the report with `--no-sandbox`. 4. The malicious content loads or exercises browser functionality. 5. If the content exploits a Chromium renderer vulnerability, the compromised process runs without normal Chromium sandbox containment. 6. The exploit may access resources available to the user account running Puppeteer, subject to operating-system permissions and any external container controls. ### Im ...[truncated 733 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73

Finding

Report Workflow Exposes the Working Directory Through a Network-Bound HTTP Server

Content

View full analysis

{const b=await p.launch({headless:'new',args:['--no-sandbox']});const pg=await b.newPage();await pg.setViewport({width:520,height:800,deviceScaleFactor:2});await pg.goto('http://localhost:18923/daily-report.html',{waitUntil:'networkidle0'});await pg.screenshot({path:'daily-report.png',fullPage:true});await b.close()})()" # Stop server kill %1 ``` ### Technical Analysis Python's `http.server` serves the current working directory and, unless explicitly restricted, binds to all available network interfaces. The documented workflow does not specify either a dedicated document root or a loopback-only bind address. The collection scripts write sensitive AWS reports into `AWS_PATROL_OUTPUT`, which defaults to the current directory. These files can contain: - Resource identifiers and names. - Private IP addresses and load-balancer DNS names. - CloudWatch alarm details. - IAM usernames and access-key identifiers. - Security findings. - Cost and reservation information. - AWS Health and SMS registration details. If the HTTP server is launched from that directory, those files and any other files in the working directory may be retrievable while the server is active. The `kill %1` cleanup also depends on interactive shell job numbering and may not execute if an earlier command fails or the workflow is interrupted. ### Attack Path 1. The patrol scripts create `aws-patrol-detail.json`, `aws-security-cost.json`, and `daily-report.html` in the current or configured output directory. 2. The operator follows the documented command and starts `python3 -m http.server 18923`. 3. The server listens on network interfaces and serves the entire current ...[truncated 1242 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This second mismatch likewise indicates that the skill's security and cost-audit claims are broader than its real behavior. When a skill is used for AWS patrol or compliance-style review, such gaps can directly lead to missed misconfigurations and uninvestigated incidents because operators assume checks were completed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This second mismatch likewise indicates that the skill's security and cost-audit claims are broader than its real behavior. When a skill is used for AWS patrol or compliance-style review, such gaps can directly lead to missed misconfigurations and uninvestigated incidents because operators assume checks were completed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown describes fully automated monitoring that collects AWS data, generates reports, takes screenshots, and delivers results to chat, but it does not include any warning about transmitting potentially sensitive infrastructure, security, and cost information. For a skill handling cloud-environment data and chat delivery, the description should disclose privacy and operational implications to the user.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises access to AWS account data and output generation but does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope constraints can let the skill access environment secrets and write files more broadly than users expect, increasing the chance of unintended credential exposure or unsafe file operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description says to use the skill for 'daily/periodic AWS monitoring, cost optimization checks, security audits, or automated reporting on AWS infrastructure health,' which is a wide set of common admin tasks. It does not provide explicit trigger phrases, exclusions, or narrower activation context, increasing the risk of unintended invocation for ordinary AWS operations discussions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template sets the document language to Chinese via lang="zh", and the visible report content is also entirely in Chinese. This imposes a specific language/locale without any indication of user opt-in or a documented region-specific constraint, which matches the natural-language locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Multiple default strings are fixed in Chinese, including weekday text and report content, which effectively forces a specific language/locale in generated output. The file does not offer user opt-in or configurable locale selection, and no justification is documented for restricting output to Chinese.

Content

No source excerpt is available for this finding.

Tainted flow: 'out_path' from os.environ.get (line 8, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script derives the output directory from the AWS_PATROL_OUTPUT environment variable and writes the generated HTML report to that path without validation or restriction. If an attacker can influence the environment in which this skill runs, they can redirect writes to arbitrary filesystem locations, causing unintended file overwrite, data clobbering, or placement of attacker-controlled HTML in sensitive or served directories.

Content

Scanner excerpt · scripts/gen-report.py (reported line 113)May include surrounding context.

python

actions_html += '</div>'
html = html.replace('{{ACTION_ITEMS}}', actions_html)

with open(out_path, 'w') as f:
    f.write(html)
print(f"Written to {out_path}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script accesses AWS profile configuration via environment variables to authenticate and then performs broad account-wide API queries. While its purpose is analysis, there is no explicit warning in code comments, docstrings, or user-facing output that it will use local AWS credentials/profile context to inspect account resources.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment indicates a straightforward rightsizing step based on existing patrol data, but the implementation references OUT_DIR prior to assigning it, causing the file read to fail and the logic to be skipped by the broad exception handler. This means the advertised rightsizing behavior is not actually performed as documented.

Content

No source excerpt is available for this finding.

Tainted flow: 'out' from os.environ.get (line 419, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/patrol-security-cost.py (reported line 420)May include surrounding context.

python

OUT_DIR = os.environ.get('AWS_PATROL_OUTPUT', os.getcwd())
out = os.path.join(OUT_DIR, 'aws-security-cost.json')
with open(out, 'w') as f:
    json.dump(result, f, indent=2, default=str)

print(f"\nDone! Written to {out}", file=sys.stderr)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and the implemented code only collect EC2, RDS, CloudWatch alarm, ELB, Health event, and SMS registration data. The manifest claims broader security posture and cost-analysis coverage, but this file contains no IAM, S3, EBS encryption, security group, Savings Plans, or Reserved Instance logic, creating a clear description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Tainted flow: 'out' from os.environ.get (line 209, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

The output path is derived from an environment variable and then used directly in a file write. If an attacker can influence the process environment, they can redirect the report to an unintended location, causing overwrite of arbitrary writable files or writing sensitive AWS inventory data into an unsafe path; the skill context increases concern because the JSON contains detailed cloud asset and health information.

Content

Scanner excerpt · scripts/patrol.py (reported line 210)May include surrounding context.

python

OUT_DIR = os.environ.get('AWS_PATROL_OUTPUT', os.getcwd())
out = os.path.join(OUT_DIR, 'aws-patrol-detail.json')
with open(out, 'w') as f:
    json.dump(result, f, indent=2, default=str)

print(f"\nDone! {result['summary']}", file=sys.stderr)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example schedule is presented only in Chinese, which implicitly imposes a specific language/locale in user-facing instructions without offering alternatives or documenting that the skill is region-specific. This can violate language/locale policy expectations when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The scheduling example is written entirely in Chinese, which imposes a specific language on users despite the rest of the skill being in English. There is no opt-in, alternative English phrasing, or justification that this skill is intended only for a Chinese-language environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs a file write to daily-report.html, which is a safety-relevant operation under the rule, but the only user-facing disclosure is an after-the-fact success print. The module docstring says it generates a report, yet there is no explicit pre-write warning or comment near the write about overwriting or creating output in the configured directory.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest description emphasizes infrastructure patrol including security posture for IAM MFA, security groups, EBS encryption, and S3, so much of this file is aligned. However, the code additionally collects broader IAM/account summary details and S3 ACL/public-access-block exposure checks that go beyond the specifically described metrics-oriented wording for this component.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The script persists collected security and cost findings to aws-security-cost.json, but the only user-facing notice appears after the write completes. Because this output may contain sensitive infrastructure metadata, users are not warned ahead of time that a local file will be created in the working directory or configured output directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script persists a detailed AWS infrastructure inventory to local disk without any explicit warning or controls around storage location, retention, or permissions. In this skill context, the report can contain instance identifiers, private IPs, load balancer DNS names, alarm state, and health-event metadata, so unanticipated persistence can expose sensitive operational data to other local users or downstream tooling.

Content

No source excerpt is available for this finding.