ClawHub
Back to skill

Security audit

Awscli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small AWS Lightsail control wrapper with high-impact instance actions that are disclosed and scoped by environment settings, but its documentation should be tightened before production use.

Install only with a tightly scoped AWS IAM user or role, set ALLOWED_INSTANCES to the exact Lightsail instances the skill may control, and treat start, stop, and reboot as actions that can cause downtime. The publisher should remove the EC2 claim or add clearly documented EC2 support and add confirmation/warning guidance for production use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill advertises EC2 and Lightsail management, but the documented behavior only covers Lightsail operations. This mismatch can mislead operators and downstream systems about what resources are being controlled, which is dangerous in infrastructure automation because users may make trust or authorization decisions based on inaccurate capability claims.

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill declares access to environment-derived capabilities but does not define an explicit tool scope such as allowed-tools or permissions. In a skill that manages cloud infrastructure, this creates ambiguity about what the agent may access and increases the chance of unintended credential or environment exposure during execution.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill exposes reboot, start, and stop operations for cloud instances without warning about service disruption or recommending confirmation controls. In infrastructure contexts, these actions can cause outages, data loss in volatile workloads, or accidental production impact if invoked casually or by an over-trusting agent.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code performs safety-critical infrastructure actions (reboot, start, and stop of Lightsail instances) via AWS CLI calls, but there is no confirmation prompt, warning message, or explanatory comment indicating these actions can affect service availability. Because these operations can disrupt running systems, the absence of any user disclosure in the code is a missing-warning issue.

Description-Behavior Mismatch

Low
Confidence
95% confidence
Finding
The manifest description at L03 says the skill manages both AWS Lightsail and EC2 instances using AWS CLI. However, the body documentation at L10 and the operation notes at L77 consistently describe Lightsail-only behavior, with no documented EC2-specific actions or inputs.

Intent-Code Divergence

Low
Confidence
78% confidence
Finding
L76 instructs not to generate AWS CLI commands, but the manifest at L03 defines the skill as operating 'using AWS CLI.' This creates an intent-level contradiction in the documentation about whether the skill should surface or rely on CLI command generation as part of its behavior.

Description-Behavior Mismatch

Low
Confidence
97% confidence
Finding
The manifest description says the skill manages both AWS Lightsail and EC2 instances. In the implementation, every AWS CLI invocation uses the Lightsail service namespace (`lightsail get-instances`, `reboot-instance`, `start-instance`, `stop-instance`) and there is no EC2 support at all. This is a semantic mismatch between the advertised scope and the actual behavior.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.js:10