Aws Fis Experiment Execute

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 1.0.0

Overview

This skill is transparent about running AWS fault-injection experiments, but it deserves review because it can affect live cloud resources and broadly collect Kubernetes/application logs by default.

Install only for approved AWS chaos-engineering work. Use least-privilege AWS and Kubernetes credentials, verify account, region, target resources, stop conditions, and maintenance window, review the required app-service-log-analysis skill first, and avoid default log collection where logs may contain secrets, customer data, or regulated information. Treat cleanup commands as destructive and run them only after a separate explicit review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The reference file for an execution-focused FIS skill includes stack, template, alarm, and dashboard deletion commands, which materially expand the skill's operational scope into destructive cleanup. In a chaos-engineering context, an agent or user following this reference could remove monitoring, stop-condition alarms, or the entire CloudFormation-managed experiment infrastructure, causing loss of safeguards and service configuration.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document states the skill does not deploy infrastructure, creating an execution-only expectation, but later includes infrastructure-deleting commands. This inconsistency can mislead operators and downstream agents into trusting the skill as non-destructive when it actually contains commands that tear down resources.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The example trigger phrases are broad enough that ordinary requests such as 'run the experiment' or 'start chaos experiment' could activate a skill that launches real AWS Fault Injection Simulator experiments against live infrastructure. In this context, accidental invocation is dangerous because the skill is explicitly designed to affect production resources, so misrouting normal conversation into this workflow can cause disruptive actions even if later confirmation is requested.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The start-experiment command launches an AWS Fault Injection Service experiment against real AWS resources, but the reference lacks an explicit warning that this is an active disruptive action. In this skill context, that omission is dangerous because users may interpret the step as routine verification rather than deliberate fault induction on live systems.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The cleanup section documents deletion of the stack, FIS template, alarms, and dashboards without explicit warnings or confirmation guidance. These commands can irreversibly remove infrastructure and safety mechanisms, especially problematic in an FIS workflow where CloudWatch alarms may serve as stop conditions or monitoring controls.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: SKILL.md:116