Security audit
Security checks for vulnerabilities and agentic risk
This AWS audit skill is mostly purpose-aligned, but its user-facing scope and read-only claims do not fully match the AWS APIs and local database changes it performs.
Review the IAM policy and exact checks before installing. Use a dedicated AWS audit user, confirm you are comfortable granting account-wide inventory and security-finding read access plus credential report generation, and treat the local GRC database as sensitive because it will store security findings and configuration evidence.
The skill declares a fixed set of AWS services but also references ELBv2 and WAF association inspection that are outside that list. For a credentialed cloud-audit tool, undeclared service access is dangerous because it defeats informed consent and can result in broader cloud visibility than the operator intended to grant.
The skill declares a fixed set of AWS services but also references ELBv2 and WAF association inspection that are outside that list. For a credentialed cloud-audit tool, undeclared service access is dangerous because it defeats informed consent and can result in broader cloud visibility than the operator intended to grant.
The skill declares a fixed set of AWS services but also references ELBv2 and WAF association inspection that are outside that list. For a credentialed cloud-audit tool, undeclared service access is dangerous because it defeats informed consent and can result in broader cloud visibility than the operator intended to grant.
The skill declares a fixed set of AWS services but also references ELBv2 and WAF association inspection that are outside that list. For a credentialed cloud-audit tool, undeclared service access is dangerous because it defeats informed consent and can result in broader cloud visibility than the operator intended to grant.
The skill declares a fixed set of AWS services but also references ELBv2 and WAF association inspection that are outside that list. For a credentialed cloud-audit tool, undeclared service access is dangerous because it defeats informed consent and can result in broader cloud visibility than the operator intended to grant.
The skill declares a fixed set of AWS services but also references ELBv2 and WAF association inspection that are outside that list. For a credentialed cloud-audit tool, undeclared service access is dangerous because it defeats informed consent and can result in broader cloud visibility than the operator intended to grant.
The skill declares executable behavior and instructs use of shell commands and Python scripts, but does not define an explicit tool scope such as allowed-tools or permissions. This weakens containment and review because a runtime may permit broader shell access than the metadata makes clear, increasing the chance of unintended command execution or environment access.
The skill is described as performing read-only AWS evidence collection, but it also writes evidence records and updates integration state in a local GRC database. This is not an AWS-side privilege escalation, but it is a scope mismatch that can surprise operators, alter compliance records, and undermine trust and change-control expectations for a supposedly read-only collection skill.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--file-content", json.dumps(result, default=str),
]
proc = subprocess.run(cmd, capture_output=True, text=True)
if proc.returncode != 0:
return _store_evidence_direct(db_path, check_name, result)
The metadata says the skill covers a defined set of AWS services, but test_connection probes additional services such as CloudWatch Logs, EKS, ECS, and ELB that are not clearly declared in the summary. In a security-sensitive environment, undeclared API calls expand the effective access footprint, may trigger monitoring alerts, and violate least-surprise expectations even if the calls are read-oriented.
The manifest description says the skill performs 15 read-only checks across specific services: S3, IAM, CloudTrail, VPC, KMS, EC2, RDS, Lambda, EBS, SQS, SNS, Secrets Manager, Config, GuardDuty, and Security Hub. This module instead registers additional check modules for CloudWatch, EKS/ECS, ELB, and IAM credential reports, while omitting several manifest-listed areas such as EBS, SQS, SNS, and Secrets Manager.
The manifest description enumerates the skill's compliance evidence collection scope as S3, IAM, CloudTrail, VPC, KMS, EC2, RDS, Lambda, EBS, SQS, SNS, Secrets Manager, Config, GuardDuty, and Security Hub. This file adds CloudWatch compliance checks for log retention and metric alarms, which expands behavior beyond the described service set.
The code calls IAM GenerateCredentialReport, which is a report-generation API that changes server-side state and is not strictly read-only. In a skill explicitly described as performing read-only compliance checks, this is a capability mismatch that can violate least-privilege assumptions, break deployments using read-only IAM policies, and create unexpected side effects in audited environments.
The manifest describes evidence collection across S3, IAM, CloudTrail, VPC, KMS, EC2, RDS, Lambda, EBS, SQS, SNS, Secrets Manager, Config, GuardDuty, and Security Hub. This file is dedicated to ELB compliance checks and also queries WAF state for load balancers, which expands the implemented service scope beyond the stated set.
The manifest describes evidence collection across S3, IAM, CloudTrail, VPC, KMS, EC2, RDS, Lambda, EBS, SQS, SNS, Secrets Manager, Config, GuardDuty, and Security Hub. This policy additionally includes EKS, ECS, ELB, WAF, CloudWatch Logs, and CloudWatch permissions, which expand the skill's operational scope beyond the services explicitly claimed in the description.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
for service_name, (client_name, method_name, kwargs) in service_probes.items():
try:
client = session.client(client_name, region_name=region)
getattr(client, method_name)(**kwargs)
results.append({"service": service_name, "status": "ok", "detail": "accessible"})
passed += 1
except client.exceptions.ClientError as e:
The function signature hard-codes region="us-east-1", which imposes a specific locale/region choice by default. Under the policy, forcing a specific locale or region without explicit user opt-in or documented justification is a natural-language policy concern.
The function signature hard-codes region="us-east-1", which imposes a specific locale/region choice by default. Under the policy, region or locale constraints should be user-selected or clearly justified, and this file does not provide such justification.
The function signature hard-codes region="us-east-1", which imposes a specific locale/region choice by default. Under the policy, fixed language or locale behavior without user opt-in or clear justification can be a natural-language policy concern, and this file does not document why that region is mandatory.
The function signature hard-codes a default region of "us-east-1", which imposes a specific locale/region choice unless the caller explicitly overrides it. Under the policy, region or locale constraints should be opt-in or clearly justified, and no justification is provided in the file.
The function signature hard-codes region="us-east-1", which imposes a specific locale/region choice by default. Under the policy, region or locale constraints should be user-selectable or clearly justified; no such opt-in or justification appears in this file.