Security audit

AWS Alert Handler

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but its AWS alert automation guidance and parser behavior can cause spoofed, injected, or silently dropped security alerts if installed without careful controls.

Review before installing in an automated incident-response path. Use a Lambda, EventBridge connection, or trusted proxy that verifies SNS signatures and expected topic/account/region before invoking an agent; avoid passing raw alert text as instructions; split or reject multi-finding batches; and consider disabling or tightening the CloudWatch skip patterns for production accounts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: references/webhook-setup.md:24
Finding: Unsigned webhook content is injected directly into an AI agent prompt
Content: View full analysis
` header, which protects against random internet traffic. But SNS HTTPS delivery does NOT carry your bearer token by default — the payload is SigV4-signed by AWS with `Signature` + `SigningCertURL` fields in the envelope, which OpenClaw does not verify. ``` ### Technical Analysis The mapping places the complete webhook-controlled `payload` directly into a message that starts an agent action. Alert fields such as titles, descriptions, state reasons, and resource data must therefore be treated as untrusted prompt content, not as instructions. A bearer token limits who can submit requests but does not make submitted text safe. In addition, the documented direct SNS integration does not verify the SNS signature. If the endpoint is exposed through a proxy that injects the bearer token, an attacker able to reach that proxy may submit a forged AWS-shaped event. A compromised authorized publisher could also place malicious instructions in legitimate alert fields. Because the payload enters the agent's conversational context without a strict data/instru ...[truncated 1502 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/webhook-setup.md:114
Finding: Suggested automatic retrieval of an unvalidated SubscribeURL can enable SSRF
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/parse-asff.sh:31
Finding: Batched security findings after the first item are discarded
Content: View full analysis
/dev/null 2>&1; then n=$(echo "$raw" | jq -r '.Findings | length') if [ "$n" -gt 1 ]; then echo "parse-asff.sh: envelope contains $n findings; emitting first only (others preserved in raw)" >&2 fi finding=$(echo "$raw" | jq -c '.Findings[0]') else finding=$(echo "$raw" | jq -c '.') fi ``` Inspector v2 processing: ```bash if echo "$raw" | jq -e '."detail-type" == "Inspector2 Finding"' >/dev/null 2>&1; then finding=$(echo "$raw" | jq -c '.detail') elif echo "$raw" | jq -e 'has("findings")' >/dev/null 2>&1; then n=$(echo "$raw" | jq -r '.findings | length') if [ "$n" -gt 1 ]; then echo "parse-inspector2.sh: list response has $n findings; emitting first only (others preserved in raw)" >&2 fi finding=$(echo "$raw" | jq -c '.findings[0]') else finding=$(echo "$raw" | jq -c '.') fi ``` ### Technical Analysis Both parsers intentionally select array index zero and emit only that finding. The remaining findings are not normalized or sent downstream. The warning that other findings are “preserved in raw” is inaccurate for the normalized output. Later output construction passes the selected `$finding` as `raw`, rather than the original batch envelope. Consequently, items after index zero are absent from both the normalized fields and the output's `raw` field. This creates a fail-open condition for security monitoring: successful exit status does not indicate that part of the batch was ignored. A downstream caller can therefore treat the batch as completely processed even though only one item was handled. ### Attack Path 1. A batch enters through an API import, custom publisher, or other delivery path that permits multip ...[truncated 873 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/parse-cloudwatch-alarm.sh:121
Finding: Alarm-name-only noise filtering can suppress legitimate incident alerts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is broader than the code’s actual behavior. The script validates that input is ASFF with SchemaVersion 2018-10-08, optionally pulls the first element from a Findings array, and normalizes that finding into a fixed output shape. It explicitly states that SNS unwrapping is handled upstream, contradicting the claim of auto-unwrapping SNS/EventBridge envelopes. It also contains no logic for CloudWatch alarm structures or Inspector v2 native finding schemas; the only Inspector-related behavior is labeling a Security Hub finding as inspector based on ProductArn. Therefore the description materially overstates supported inputs and envelope handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broader multi-source normalizer for Security Hub ASFF, Inspector v2, and CloudWatch alarms, with automatic SNS and EventBridge envelope unwrapping. This script is much narrower: it only recognizes CloudWatch alarm inputs and explicitly states SNS envelope unwrapping is handled upstream, not here. EventBridge handling is limited to CloudWatch alarm event shape detection rather than general envelope unwrapping for multiple alert types. Additionally, it contains skip logic for specific alarm-name patterns, causing some alerts to be suppressed rather than merely normalized; that behavior is not mentioned in the description. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broader parser that can normalize Security Hub ASFF, Inspector v2, and CloudWatch alarms, and that auto-unwraps both SNS and EventBridge envelopes. The supplied code chunk is narrowly scoped to Inspector v2 only: it validates Inspector-specific fields (findingArn, severity, type), unwraps only EventBridge, and explicitly notes that SNS envelope unwrapping is done by another upstream component. The extra inspector_score field is a supporting detail and not a mismatch by itself. However, the primary purpose and supported input types are materially narrower than declared, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.