Security audit

Cloud CIS Benchmarks Audit

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with cloud CIS auditing, but it includes under-scoped remediation commands that can change live cloud resources across an account.

Install only if you will treat it as guidance for experienced cloud operators, not as a safe automatic remediation runbook. Use read-only credentials for audits, verify provider and benchmark coverage separately, review every remediation command before use, target only confirmed resources, preserve existing encryption and logging settings, and require normal change approval for production accounts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/agent.py:91
Finding: Default Security Group Check Can Falsely Report CIS Compliance
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/agent.py:27
Finding: AWS API Errors Are Misclassified as Confirmed Compliance Failures
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:137
Finding: Bulk S3 Remediation Can Overwrite Stronger Encryption Configuration
Content: View full analysis
/dev/null && echo "Encrypted: $bucket" || echo "FAILED: $bucket" done ``` ### Technical Analysis The documented command calls `put-bucket-encryption` for every bucket in the account and unconditionally supplies an `AES256` configuration. It does not first inspect or preserve an existing encryption policy. S3 buckets may already use stronger or governance-required configurations, including: - SSE-KMS with a customer-managed KMS key - DSSE-KMS - Bucket keys and related encryption parameters - Organization-specific KMS controls Because `put-bucket-encryption` replaces the bucket's server-side encryption configuration, following this remediation can replace an existing KMS-based policy with SSE-S3. Redirecting standard error to `/dev/null` also suppresses diagnostic information needed to distinguish permission failures, policy restrictions, and service errors. The loop applies account-wide rather than targeting only confirmed noncompliant buckets. ### Attack Path 1. One or more buckets are already configured with SSE-KMS, DSSE-KMS, or an organization-mandated customer-managed key. 2. An operator follows the remediation instructions with an identity authorized to modify S3 encryption. 3. The loop enumerates all buckets, including already compliant buckets. 4. `put-bucket-encryption` replaces each accessible bucket's existing configuration with `AES256`. 5. The affected buckets lose their KMS-based default encryption control ...[truncated 932 chars]
Remediation: View remediation
/dev/null`; capture and classify errors. 9. Validate the resulting configuration after each change. 10. Use change approval and rollback procedures for production buckets. A safer pattern is to inspect before writing: ```bash aws s3api get-bucket-encryption --bucket "$bucket" ``` Only when the response confirms that no approved configuration exists should a reviewed encryption policy be applied. The target algorithm and KMS key should come from organizational policy rather than being hardcoded to `AES256`. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose presents a broad instructional or operational capability for CIS-based cloud security auditing across AWS, Azure, and GCP, including remediation and continuous compliance workflows. The supplied code only implements a narrow AWS-specific command-line auditor using boto3 for a handful of CIS AWS Foundations controls. While the AWS CIS auditing portion partially aligns, the primary scope and capabilities are materially narrower than declared, especially regarding Azure/GCP support, third-party tool usage, remediation, and continuous monitoring.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states read-only audit prerequisites but later provides commands that delete access keys, enable encryption, create trails, and configure monitoring. This can mislead users or agents into performing privileged, state-changing actions in production under the guise of an audit, creating risk of unintended outages, policy violations, or destructive changes.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The remediation examples include destructive and configuration-changing commands, such as deleting access keys and bulk-modifying bucket encryption, without an explicit safety warning or guardrails. In a cloud operations context, users may copy-paste these commands into live environments, causing service disruption, loss of emergency access, or unreviewed security changes.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata and module docstring imply broader CIS benchmark coverage than the code actually provides, but the implementation is AWS-only via boto3. In a security auditing skill, this can mislead operators into believing Azure and GCP were assessed when they were not, creating dangerous gaps in compliance and detection coverage.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The docstring broadly states the agent audits against CIS Benchmarks, while the implementation only covers a limited set of AWS CIS controls. In a security context, overstated audit coverage can cause users to over-trust results and miss unassessed services, accounts, or cloud platforms.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest says the skill covers running automated assessments with tools like Prowler and ScoutSuite, which implies integration or operational handling of those assessment tools. The implementation instead runs a small set of handwritten boto3 checks and generates its own JSON report, which is materially narrower than the described behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.