aws-agentcore-langgraph

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:32 AM UTC
• Version: 1.0.2

Overview

This is a coherent AWS AgentCore and LangGraph reference skill, but users should treat it as cloud deployment guidance that can create persistent memory, external integrations, and deletable AWS resources.

Install in a virtual environment, prefer pinned versions or a lockfile, and use a least-privilege AWS profile. Before using memory or gateway examples with real data, confirm what will be stored or sent to AWS and any connected third-party service. Treat destroy/delete commands as potentially destructive and verify the target account, region, and resource before running them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–13
Vulnerability Type: Unpinned executable dependencies
Risk Level: Medium

bash

## Install
pip install bedrock-agentcore bedrock-agentcore-starter-toolkit langgraph
uv tool install bedrock-agentcore-starter-toolkit  # installs agentcore CLI

Technical Analysis

The installation instructions do not pin package versions or verify package integrity with cryptographic hashes. Consequently, package managers resolve and install whichever versions of these packages and their transitive dependencies are available at installation time.

Python package installation may execute package build hooks and other installer-controlled code. If a named package, one of its transitive dependencies, or the configured package index is compromised, following these instructions could execute attacker-controlled code. The unpinned dependencies also make builds non-reproducible and allow future upstream changes to alter the reviewed behavior without changes to this project.

No evidence indicates that the currently named packages are malicious. The finding concerns the unsafe dependency acquisition method.

Attack Path

1. An attacker compromises a named package, a transitive dependency, its publisher account, or the package index used by the victim.
2. The attacker publishes a malicious release that satisfies unrestricted dependency resolution.
3. A user follows the documented pip install or uv tool install command.
4. The package manager downloads the attacker-controlled release.
5. Malicious installation hooks or runtime code execute with the privileges of the installing user.
6. If that user has AWS credentials or an active AWS profile, the malicious code may access resources permitted by those credentials.

Impact Assessment

Successful exploitation could provide code execution with the installing user's local privileges. The affected scope may in ...[truncated 328 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed, exact version rather than allowing unrestricted resolution.
• Generate and commit a lockfile that records reviewed transitive dependency versions.
• Verify downloaded artifacts with cryptographic hashes, using mechanisms such as pip --require-hashes where practical.
• Explicitly document and enforce trusted package indexes; disable unneeded fallback or extra indexes to reduce dependency-confusion exposure.
• Install packages in an isolated virtual environment or container under a non-privileged account.
• Perform dependency vulnerability and provenance scanning in CI before approving lockfile updates.
• Review release notes and package ownership changes before upgrading.
• Avoid exposing unnecessary AWS credentials during dependency installation, and use least-privilege IAM roles for later deployment operations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a broad capability for deploying and managing complex LangGraph agent ecosystems on AWS Bedrock AgentCore. In contrast, the supplied code only performs a narrow operational task: tailing CloudWatch runtime logs for an existing agent runtime. While log tailing could be considered a small observability support utility, it does not substantively implement the core declared capabilities such as deployment, orchestration, memory, tool integration, or distributed context management. Therefore the code chunk's actual behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

| `Model use case details not submitted` | Fill Anthropic form in Bedrock Console |
| `Invalid agent name` | Use underscores not hyphens |
| Memory empty after write | Wait ~10s (eventual consistency) |
| Container not reading .env | Set ENV in Dockerfile, not .env |
| Memory not working after deploy | Check logs for "Memory enabled/disabled" |
| `list_events` returns empty | Check actor_id/session_id match; `event['payload']` is a list |
| Gateway "Unknown tool" | Lambda must strip `___` prefix from `bedrockAgentCoreToolName` |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages persistent cross-session memory but does not warn that prompts, user data, and derived facts may be retained across sessions and agents. In an agent framework, this can lead to unintended storage of sensitive data, privacy violations, or retention beyond user expectations, especially when shared context is a core feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The deployment, gateway, and invocation instructions cause data to be transmitted to AWS services and potentially external APIs, yet the skill omits warnings about those outbound flows. Users may unknowingly send sensitive prompts, session context, or tool parameters to cloud-hosted services or third-party integrations without understanding the trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Line L24 lists agentcore destroy as a cleanup command, which implies potentially irreversible resource deletion, but the document provides no warning, confirmation note, or caution about destructive effects. In markdown files, destructive behaviors that may affect user data or system integrity should be accompanied by an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guide demonstrates configuring gateway targets and invoking MCP-compatible tools, including third-party/API-backed integrations, but does not warn that tool inputs and outputs may be transmitted to external services. In this context, users may pass sensitive prompts, identifiers, customer data, or credentials through the gateway without understanding the data-flow boundary, creating privacy, compliance, and unintended disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation explicitly instructs users to store conversation events and describes long-term, cross-session memory, but it does not include any caution about collecting personal data, retention limits, consent, minimization, or deletion workflows. In a production agent platform, this omission can lead developers to persist sensitive user content by default, increasing privacy, compliance, and data exposure risk if the memory store is misused or later compromised.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/agentcore-runtime.md (reported line 73)May include surrounding context.

bash

python agent.py
curl -X POST http://localhost:8080/invocations -H "Content-Type: application/json" -d '{"prompt":"Test"}'
curl http://localhost:8080/ping  # Health check

Static analysis

No suspicious patterns detected.