AWS Health Monitor

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:15 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it polls the public AWS Health feed and sends configured outage notifications, with disclosed local state and optional cron use.

Before installing, confirm you want a scheduled monitor that can make outbound requests to AWS Health and send outage messages to your configured notification target. Set `AWS_HEALTH_NOTIFY_TARGET` carefully, use region/service filters if you do not want broad monitoring, and only add the cron entry if continuous polling is desired.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents capabilities that involve environment variables, filesystem writes, network access, and shell/Cron execution, but it does not declare any explicit tool scope or permission boundaries. This creates a real security issue because an agent may invoke the skill with broader-than-expected privileges, increasing the chance of unauthorized file modification, network egress, or secret exposure via environment variables and logs.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to activate when the user 'wants to watch AWS service health, set up alerts for AWS outages, or check current AWS regional incidents,' which is a broad natural-language condition rather than a specific invocation scope. It does not provide explicit trigger phrases, exclusions, or negative examples, so it could overlap with general AWS troubleshooting requests and cause unintended invocation.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The skill documentation and examples are predominantly in Chinese, including labels and notification examples, without indicating that language is user-selectable or optional. This can violate language/locale policy if the skill implicitly constrains output language regardless of user preference.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file's top-level description and inline user-facing text are written entirely in Chinese, indicating the skill is intended to operate in a fixed language. There is no natural-language indication that users may opt into another language or that the locale restriction is justified as region-specific, which matches the language/locale policy violation criteria.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

now = datetime.now(CST).strftime("%Y-%m-%d %H:%M:%S")
    if notifications:
        for msg in notifications:
            result = subprocess.run(
                ["openclaw", "message", "send",
                 "--channel", NOTIFY_CHANNEL,
                 "--target", NOTIFY_TARGET,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Tainted flow: 'NOTIFY_CHANNEL' from os.environ.get (line 27, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

now = datetime.now(CST).strftime("%Y-%m-%d %H:%M:%S")
    if notifications:
        for msg in notifications:
            result = subprocess.run(
                ["openclaw", "message", "send",
                 "--channel", NOTIFY_CHANNEL,
                 "--target", NOTIFY_TARGET,

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The only natural-language guidance in this file is written in Chinese, which imposes a specific language on users without any opt-in or indication that the file is intended solely for a Chinese-speaking or region-specific audience. Under the policy, language-specific instructions should either provide a choice or clearly justify the locale restriction.

Static analysis

No suspicious patterns detected.