Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small AWS Lightsail control wrapper with high-impact instance actions that are disclosed and scoped by environment settings, but its documentation should be tightened before production use.
Install only with a tightly scoped AWS IAM user or role, set ALLOWED_INSTANCES to the exact Lightsail instances the skill may control, and treat start, stop, and reboot as actions that can cause downtime. The publisher should remove the EC2 claim or add clearly documented EC2 support and add confirmation/warning guidance for production use.
The skill advertises EC2 and Lightsail management, but the documented behavior only covers Lightsail operations. This mismatch can mislead operators and downstream systems about what resources are being controlled, which is dangerous in infrastructure automation because users may make trust or authorization decisions based on inaccurate capability claims.
The skill declares access to environment-derived capabilities but does not define an explicit tool scope such as allowed-tools or permissions. In a skill that manages cloud infrastructure, this creates ambiguity about what the agent may access and increases the chance of unintended credential or environment exposure during execution.
The skill exposes reboot, start, and stop operations for cloud instances without warning about service disruption or recommending confirmation controls. In infrastructure contexts, these actions can cause outages, data loss in volatile workloads, or accidental production impact if invoked casually or by an over-trusting agent.
The code performs safety-critical infrastructure actions (reboot, start, and stop of Lightsail instances) via AWS CLI calls, but there is no confirmation prompt, warning message, or explanatory comment indicating these actions can affect service availability. Because these operations can disrupt running systems, the absence of any user disclosure in the code is a missing-warning issue.
The manifest description at L03 says the skill manages both AWS Lightsail and EC2 instances using AWS CLI. However, the body documentation at L10 and the operation notes at L77 consistently describe Lightsail-only behavior, with no documented EC2-specific actions or inputs.
L76 instructs not to generate AWS CLI commands, but the manifest at L03 defines the skill as operating 'using AWS CLI.' This creates an intent-level contradiction in the documentation about whether the skill should surface or rely on CLI command generation as part of its behavior.
The manifest description says the skill manages both AWS Lightsail and EC2 instances. In the implementation, every AWS CLI invocation uses the Lightsail service namespace (lightsail get-instances, reboot-instance, start-instance, stop-instance) and there is no EC2 support at all. This is a semantic mismatch between the advertised scope and the actual behavior.
Detected: suspicious.dangerous_exec
