Security audit

AWS | Amazon Web Services

Security checks across malware telemetry and agentic risk

Overview

This AWS skill is broad and persistent, but its local storage, AWS CLI use, and safety limits are disclosed and fit its infrastructure-management purpose.

Install this only if you want the agent to use AWS CLI context and maintain local Clawic notes about your AWS accounts, inventory, spend, runbooks, and security findings. Do not install it on a shared workstation unless those local files are protected, because they may contain account IDs, ARNs, resource names, policy structure, and operational history, though the skill instructs agents not to store credential values.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Low

Confidence: 93% confidence
Finding: The skill directs the agent to read and update local memory files under a home-directory path as part of answering spend questions, even though those files are not necessary for AWS API operations themselves. This creates a cross-scope data access and persistence behavior: an AWS-cost skill can exfiltrate or modify unrelated local state, and the instruction is framed as mandatory pre/post behavior rather than optional with user consent.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The skill description is extremely broad and can trigger on many ordinary AWS-related conversations, increasing the chance that it activates when the user did not explicitly intend to use it. In this skill, activation is more sensitive because the instructions immediately direct the agent to read multiple local files and infer environment context, so over-triggering expands unnecessary data access and behavioral influence.

Natural-Language Policy Violations

Low

Confidence: 74% confidence
Finding: The skill states that values should be sourced from shared profile data, including locale/currency-style universals, before explicit session confirmation. This can cause the agent to apply cross-skill profile preferences without the user's immediate opt-in, which is a privacy and autonomy issue even if the data stays local.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The file explicitly instructs the agent to write back billing-review results to local memory files in the same turn, without warning the user that local data will be modified. Silent persistence is dangerous because it can overwrite trusted notes, poison future agent decisions, and create an audit/privacy issue by storing billing and operational details without explicit authorization.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The document recommends forcing an RDS failover with `aws rds reboot-db-instance --force-failover` as a test step, but it does not explicitly warn that this is a disruptive operation that should only be performed in a non-production environment with authorization and rollback planning. Even though the surrounding text says 'in a non-production environment,' the command is operationally destructive enough that a clearer safety warning would reduce the risk of accidental service impact if copied blindly.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The instruction tells users to persist IAM policy artifacts to a fixed local path, but it does not warn that those artifacts may contain sensitive account identifiers, ARNs, policy structure, and access patterns that can aid lateral movement or privilege escalation if the workstation, repo, or shared home directory is exposed. Even with 'secret values replaced by pointer' language, the saved file still centralizes security-relevant metadata and creates an unnecessary durable copy unless storage, access controls, and retention are defined.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The template explicitly authorizes autonomous writes and deletions without requiring explicit user confirmation at the time of modification. In an agent skill, this can lead to silent persistence, alteration, or removal of user data based on model judgment, which is risky even if constrained to configured paths.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The file explicitly instructs the agent to write scan results into local memory files under `~/Clawic/data/...` without requiring user confirmation or warning that local state will be modified. In an agent context, this can cause unintended persistence of sensitive infrastructure details and creates a data-handling side effect that users may not expect from a security review skill.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: memory-template.md:51