Watadot Aws Ec2

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If used with real AWS permissions, these commands can start, stop, or permanently terminate EC2 instances, affecting uptime and costs.

Why it was flagged

The skill documents AWS CLI lifecycle operations, including instance termination. This is aligned with EC2 management and is marked as dangerous, but it can still disrupt workloads if run unintentionally.

Skill content

aws ec2 start-instances --instance-ids <id1> <id2>
aws ec2 stop-instances --instance-ids <id>

# Terminate instance (DANGER)
aws ec2 terminate-instances --instance-ids <id>

Recommendation

Use explicit user approval for lifecycle changes, verify the AWS account and region first, and prefer least-privilege IAM permissions.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The agent may act with the same AWS privileges as the configured CLI profile, including changing network access rules if that profile allows it.

Why it was flagged

The skill relies on the local AWS CLI and includes account-mutating EC2 and security-group operations. Those commands will use whatever AWS credentials and permissions are configured locally.

Skill content

requires:
  anyBins: [aws]
...
aws ec2 authorize-security-group-ingress --group-id <sg-id> --protocol tcp --port 22 --cidr <your-ip>/32

Recommendation

Run this only with a dedicated AWS profile or role scoped to the needed EC2 actions, and confirm the target account, region, instance IDs, and CIDR ranges before execution.