AWS | Amazon Web Services

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:55 PM UTC
• Version: 1.0.7

Overview

This is a coherent AWS operations skill; it uses normal AWS CLI access and scoped local notes, with the main caution being automatic local memory and inventory updates.

Install only if you are comfortable letting the skill use your configured AWS CLI identity for AWS work and keep local operational notes such as account IDs, resource names, spend history, and generated runbooks under ~/Clawic/data/. Review commands before allowing account changes, especially create, modify, delete, terminate, force, S3 sync, and IAM-related operations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (18)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md

- **Lambda-first vs containers-first.** Spiky or low traffic → Lambda wins on idle cost; duty cycle above ~40% or a strict p99 requirement → Fargate/ECS. The break-even math, not the preference, decides (`services.md`).
- **Multi-account from day one.** Solo builder → one account plus budgets is fine; any team, or any compliance regime → Organizations now, because moving live resources between accounts later is a migration project, not a setting (`accounts.md`).
- **NACLs.** Most practitioners leave them at default allow-all and do all control in security groups: NACLs are stateless, so every rule needs a matching ephemeral-port return rule and a missing one produces intermittent failures that cost hours. Use them only for explicit subnet-level deny lists.
- **Terraform vs CloudFormation/CDK.** The frontier is who owns state: teams without reliable remote-state discipline get fewer 3am problems from CloudFormation's managed state and native drift detection; teams with multi-cloud footprints or heavy module reuse get more leverage from Terraform. Both lose to console clicking.

## Security & Privacy

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

export AWS_PROFILE=prod AWS_REGION=eu-west-1 # never rely on an implicit default

text

Credential precedence, highest first: command-line flags → environment variables → the profile named by `AWS_PROFILE` → `~/.aws/credentials` default → container credentials → instance role. `aws configure list` prints which one is actually in effect, and it settles most "wrong account" incidents in one line.

`ExpiredToken` on every call means an SSO session or an assumed-role session ran out — re-login rather than debugging the permission.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · accounts.md (reported line 56)May include surrounding context.

export AWS_PROFILE=prod AWS_REGION=eu-west-1 # never rely on an implicit default

text

Credential precedence, highest first: command-line flags → environment variables → the profile named by `AWS_PROFILE` → `~/.aws/credentials` default → container credentials → instance role. `aws configure list` prints which one is actually in effect, and it settles most "wrong account" incidents in one line.

`ExpiredToken` on every call means an SSO session or an assumed-role session ran out — re-login rather than debugging the permission.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · commands.md (reported line 17)May include surrounding context.

export AWS_PROFILE=prod AWS_REGION=eu-west-1 # never rely on an implicit default

text

Credential precedence, highest first: command-line flags → environment variables → the profile named by `AWS_PROFILE` → `~/.aws/credentials` default → container credentials → instance role. `aws configure list` prints which one is actually in effect, and it settles most "wrong account" incidents in one line.

`ExpiredToken` on every call means an SSO session or an assumed-role session ran out — re-login rather than debugging the permission.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · commands.md (reported line 24)May include surrounding context.

Assuming a Role

bash

# Declarative: put it in ~/.aws/config and let the CLI handle refresh
# [profile prod-admin]
# role_arn = arn:aws:iam::111122223333:role/Admin
# source_profile = default

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 90% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · iac.md (reported line 60)May include surrounding context.

md

## Remote State on AWS

- S3 backend with versioning and default encryption on the bucket. Versioning is what lets you recover from a corrupted or truncated state file, and it is the only recovery that exists.
- Locking: Terraform 1.10+ supports S3-native locking (`use_lockfile = true`), replacing the separate DynamoDB lock table. On older versions, keep the DynamoDB table — running without any lock means two concurrent applies silently corrupt state.
- One state file per stack per environment. A single state file for everything means every apply risks everything, and `terraform apply -target` becomes routine, which is the road to permanent drift.
- Never edit state by hand. `state mv`, `state rm`, and `import` cover the legitimate operations; a text editor covers none of them.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 49)May include surrounding context.

md

Nothing under `~/Clawic/data/` ever holds a secret value — not the files named here, not files you create, not text the user pastes in and asks you to keep. Store the pointer in its place, in this shape: `<kind>:<locator>`.

`ssm:/prod/db/password` · `secretsmanager:prod/api/key` · `env:AWS_PROFILE` · `keychain:aws-prod` · `1password:Work/AWS/prod` · `profile:prod` · `file:~/.ssh/id_ed25519`

When the user pastes something to save, replace each secret value before writing and leave the pointer visible: `password: <ssm:/prod/db/password>`. Say in one line that you did it.

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 90% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · networking.md (reported line 90)May include surrounding context.

md

## Metadata Endpoint

`169.254.169.254` is reachable from any instance, which is why an SSRF bug in an application becomes credential theft. IMDSv2 (`--http-tokens required`) turns a one-line SSRF into a multi-step attack that most payloads do not implement. On ECS container instances, also stop containers from borrowing the *host's* instance role: set the agent's `ECS_AWSVPC_BLOCK_IMDS=true` for awsvpc tasks, and give the task its own task role instead.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · commands.md (reported line 75)May include surrounding context.

bash

aws ec2 terminate-instances --instance-ids i-xxx --dry-run   # permission and validity check, no action
aws s3 sync ./local s3://bucket --dryrun                     # prints what would transfer
aws cloudformation deploy --no-execute-changeset             # creates a change set for review
terraform plan -out=plan.out                                 # review, then apply exactly that file

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · commands.md (reported line 133)May include surrounding context.

bash

aws ec2 terminate-instances --instance-ids i-xxx --dry-run   # permission and validity check, no action
aws s3 sync ./local s3://bucket --dryrun                     # prints what would transfer
aws cloudformation deploy --no-execute-changeset             # creates a change set for review
terraform plan -out=plan.out                                 # review, then apply exactly that file

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · commands.md (reported line 134)May include surrounding context.

bash

aws s3 sync ./dist s3://bucket/prefix --delete --exact-timestamps
aws s3 cp s3://bucket/big.tar.gz - | tar xz -C /target        # stream, never land the file
aws s3api list-object-versions --bucket b --prefix p          # what versioning is actually keeping
aws s3 presign s3://bucket/key --expires-in 300               # 5-minute share, no public bucket
aws configure set default.s3.max_concurrent_requests 20       # tune parallelism for large transfers

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to read from and write to local memory files outside the immediate AWS advisory task, creating persistent side effects and expanding the trust boundary from cloud guidance into local state manipulation. In an agent setting, this can leak billing history, corrupt shared memory, or let adversarial prompt content plant durable instructions that affect later runs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to persist derived IAM policy artifacts to a local path and update a memory file, but it does not warn that IAM policies, role names, account IDs, ARNs, and related operational notes can be sensitive infrastructure metadata. In an agent setting, this creates a risk of unintended local data retention, cross-task leakage, or writing sensitive cloud configuration details into broadly accessible memory/artifact stores.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template explicitly authorizes autonomous writes without user permission, including persistent modifications to local files, while only requiring a one-line announcement after the fact. In an agent setting, this weakens user control over side effects and can lead to silent persistence, unintended data retention, or modification of shared state without meaningful consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The split procedure instructs the agent to delete content from memory.md as part of routine maintenance, but does not require explicit confirmation or a reversible workflow. Any automated destructive edit to durable user data creates risk of data loss, corruption, or orphaned references if the move/delete sequence is interrupted or performed incorrectly.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · storage.md (reported line 52)May include surrounding context.

md

## S3 Access Precedence

Precedence, highest first: an explicit deny anywhere → account-level Block Public Access → bucket policy → ACL. **Policies override ACLs**, which is why a bucket whose ACL reads "private" can still be world-readable. Turn the whole class off at the account level rather than auditing bucket by bucket: `aws s3control put-public-access-block` with all four flags true.

- Static websites do not need a public bucket: CloudFront with Origin Access Control reaches a private bucket and gives you TLS, caching, and logs.
- Time-limited sharing → presigned URLs. A presigned URL is a bearer token: anyone holding it has the access, so make the expiry minutes, not days, and generate it server-side.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

This file contains commands that create or modify AWS resources and settings, such as creating VPC endpoints, budgets, anomaly monitors/subscriptions, and log retention policies. While AWS operations are generally related to the parent skill, this specific document is framed as cost-control guidance and mixes diagnostics with write actions that should be explicitly indicated if the intended behavior is advisory versus operational.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file instructs the agent to write discovered infrastructure details into local memory files without any user confirmation or clear authorization boundary. That creates an unauthorized persistent side effect and may store sensitive account topology or host information on disk, increasing exposure if the local workspace is shared, later exfiltrated, or reused in unrelated sessions.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:51