Description-Behavior Mismatch
Medium
- Confidence
- 95% confidence
- Finding
- The script automatically assigns `public-read` ACLs for buckets whose purpose is `website` or `assets`, even though the skill is framed broadly as bucket creation and configuration guidance. This creates a real risk of unintended public exposure of stored objects, especially in batch mode where users may not realize some buckets will be internet-readable by default.
