Security audit

Aws Fis Experiment Prepare

Security checks across malware telemetry and agentic risk

Overview

This skill is for AWS fault-injection setup, but it can automatically create, modify, and delete live cloud resources, so it needs review before installation.

Install only if you intend to let an agent deploy AWS FIS preparation stacks, not merely draft files. Use a non-production or explicitly approved account and region, review generated CloudFormation before deployment, require a least-privilege CloudFormation service role, add CloudWatch alarm stop conditions for disruptive experiments, and confirm cleanup expectations for CloudFormation resources and any shared EKS RBAC objects.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The script performs real operational actions by deploying and deleting CloudFormation stacks, while the skill is described as preparing or generating AWS FIS experiment configurations. That mismatch expands the blast radius from configuration generation to live infrastructure mutation, which is especially risky in an agent context where users may not expect side effects.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Automatically deleting a failed stack gives the skill destructive operational capability that is not necessary for merely preparing an experiment configuration. In practice, this can remove resources or evidence needed for debugging and can cause unintended outages or loss of manually created dependent resources if invoked in the wrong environment.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Using CAPABILITY_NAMED_IAM allows the deployed template to create or modify named IAM resources, which materially increases privilege and persistence risk beyond simple FIS configuration generation. If a template is overly broad or maliciously altered, the script enables privileged identity changes in the target AWS account.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly states the skill will generate configuration and then deploy it to AWS via CloudFormation with automatic delete-and-retry behavior, but it does not foreground a strong warning that this changes live cloud infrastructure and may delete/recreate stacks during error recovery. In this context, the skill targets fault-injection infrastructure, IAM roles, alarms, dashboards, Lambda-backed custom resources, and tagging operations, so under-informed use could cause unexpected account changes and widen operational blast radius.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The README says the skill will query the user's AWS resources and read AWS documentation, but it does not describe what metadata may be collected, how much account inventory may be enumerated, or how that information is handled. While this is less severe than the deployment risk, the skill context involves broad discovery across potentially sensitive infrastructure identifiers, so lack of disclosure can create privacy and least-privilege concerns.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly describes automatic CloudFormation deployment, deletion of failed stacks, retry loops, and post-deployment file updates, but does not present an explicit user-facing safety warning or consent boundary before performing these state-changing operations. In this skill context, the behavior targets live AWS infrastructure and IAM-managed resources, so unclear disclosure materially increases the risk of unintended destructive or high-impact changes in a production account.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The documentation states that the skill reads AWS documentation pages and queries real AWS resources for discovery and validation, but it does not clearly warn users that external documentation fetches and cloud API enumeration will occur. In a security-sensitive enterprise environment, this can expose metadata access patterns, surprise users with account reconnaissance activity, and violate expectations around data handling or outbound requests.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to generate CloudFormation, deploy it into AWS, and repeatedly delete and retry failed stacks without requiring a clear user confirmation or warning that real cloud resources will be created, modified, and removed. In a chaos-engineering/FIS context, this is especially risky because preparation is not read-only: it can create IAM roles, dashboards, experiment templates, and trigger destructive infrastructure churn during self-healing retries.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Defaulting stop conditions to `source: "none"` removes an important safety control for fault-injection experiments, yet the skill does not require a user-facing warning or acknowledgment. In the context of AWS FIS, missing stop alarms can allow an experiment to continue while service health degrades, increasing the chance of unnecessary outage duration or blast radius.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The base CloudFormation example configures FIS with `StopConditions: - Source: 'none'`, which means experiments will continue until completion even if service health degrades unexpectedly. In the context of chaos engineering and fault injection, this increases the chance that disruptive actions persist longer than intended, especially if users copy the template verbatim without adding a CloudWatch alarm-based stop condition.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This guide provides concrete instructions for disruptive ElastiCache reboot and failover experiments but does not prominently require non-production use, change approval, or explicit stakeholder authorization before execution. In a skill that prepares ready-to-run chaos templates, that omission increases the chance of operators applying fault injection to production systems and causing avoidable outages or customer impact.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The AZ power interruption section describes an action that intentionally degrades availability, triggers failover, and blocks replica replacement for the full action duration, yet it lacks a high-visibility operational warning restricting use to approved test environments or tightly controlled production exercises. Because this skill is specifically designed to generate experiment configurations, the missing warning materially raises the risk of serious service disruption if a user applies the template to live ElastiCache replication groups.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README template provides ready-to-run commands that deploy, start, and delete AWS FIS and CloudFormation resources, but it does not include an explicit safety warning that these actions can intentionally disrupt production-like systems and may incur cost or cause service impact. In a chaos engineering skill, omission of such warnings increases the chance that users execute disruptive commands in the wrong account, region, or environment without understanding the blast radius.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script deletes the failed stack immediately after a deployment error without prompting the user. In an agent-driven workflow, this removes a human checkpoint before a destructive action and can lead to accidental cleanup of resources in the wrong account, region, or stack name context.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:299