ClawHub
Back to skill

Security audit

Aws Agent Orchestrator Free

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate AWS agent deployment guide, but it under-discloses cloud deployment, public endpoint, deletion, dependency, and secret-handling risks.

Review this skill carefully before installing. Use it only in an isolated development environment with least-privilege AWS credentials, pin and review dependencies, avoid sending sensitive prompts to deployed endpoints, do not put secrets in Dockerfiles, and confirm the exact AWS target before launch or destroy commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:49
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-50
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable commands:

bash
pip install bedrock-agentcore bedrock-agentcore-starter-toolkit langgraph
uv tool install bedrock-agentcore-starter-toolkit

Technical Analysis

The installation instructions do not constrain package versions and do not verify package integrity with hashes or a lockfile. Each invocation can therefore resolve to a different package release depending on when it is run and which package index is configured.

Python packages may execute package-controlled build or installation logic. If an upstream package, maintainer account, release pipeline, or configured package index is compromised, following these instructions could execute attacker-controlled code. The absence of version constraints also makes it difficult to review, reproduce, and approve the exact dependency set before installation.

No evidence establishes that the named packages are currently malicious. The vulnerability is the unsafe dependency acquisition process rather than a confirmed malicious payload in a specific package release.

Attack Path

  1. An attacker compromises a named package, its maintainer account, its release process, or a package index used by the victim.
  2. The attacker publishes a malicious version that satisfies the unrestricted package request.
  3. A user follows the Skill instructions and runs pip install or uv tool install.
  4. The package manager resolves and downloads the attacker-controlled release.
  5. Malicious package installation or runtime code executes with the privileges of the installing user.
  6. The attacker can access data and perform operations available to that user and the resulting agent environment.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account performi ...[truncated 539 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every dependency to a reviewed, exact version.
  • Generate and commit a lockfile that records all transitive dependency versions.
  • Require package hashes where supported, such as through a hash-locked requirements file.
  • Install only from explicitly approved package indexes over authenticated HTTPS.
  • Prevent dependency confusion by controlling index priority and reserving internal package names.
  • Scan resolved packages and container images for known vulnerabilities before deployment.
  • Perform installation in an isolated, non-privileged virtual environment or build container.
  • Use automated dependency update tooling so upgrades are reviewed and tested rather than implicitly accepted at installation time.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:291
Finding

Recommendation to Store Secrets in Dockerfile ENV Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 291; repeated at line 302
Vulnerability Type: Insecure container secret management
Risk Level: High

Vulnerable recommendation:

text
Set environment variables through an ENV instruction in the Dockerfile, or inject them through parameters during agentcore configuration.

The troubleshooting table repeats the unsafe Dockerfile guidance:

text
If the container cannot read .env, set the value with an ENV instruction in the Dockerfile.

Technical Analysis

The document recommends using a Dockerfile ENV instruction as a replacement when a container cannot read a local .env file. If users apply this recommendation to credentials, API keys, tokens, or other secrets, those values can become part of the image configuration or filesystem layers.

Removing or overwriting a value in a later layer does not reliably remove it from earlier image layers. Users with permission to pull or inspect the image may consequently recover embedded values. The risk is especially significant when images are uploaded to shared registries, copied between accounts, cached by build systems, or exported for troubleshooting.

Environment variables are not inherently secure secret storage. Sensitive values should be injected only at runtime through a dedicated secret-management mechanism and should not be placed in Dockerfiles, build arguments, source control, or image layers.

Attack Path

  1. A user follows the troubleshooting recommendation after discovering that the deployed container does not load .env.
  2. The user places an AWS credential, API token, or other secret in a Dockerfile ENV instruction.
  3. The image is built, cached, pushed to a registry, or shared with another environment.
  4. An attacker or unauthorized user obtains image pull or inspection access.
  5. The attacker examines the image configuration, layer history, or extracted layers and r ...[truncated 790 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all recommendations to place sensitive values in Dockerfile ENV instructions.
  • Use AWS Secrets Manager or AWS Systems Manager Parameter Store for sensitive deployment configuration.
  • Grant the workload an appropriately scoped IAM role and retrieve secrets at runtime.
  • For local execution, inject environment variables at container startup from a file excluded from source control, while recognizing that process-level environment access still requires protection.
  • Do not pass secrets through Docker build arguments because they may also be retained in build history or caches.
  • Separate non-sensitive configuration from credentials and clearly document which values are safe to include in an image.
  • Apply least-privilege policies, short expiration periods, and automated credential rotation.
  • Scan source repositories, image histories, registries, and CI logs for previously embedded secrets.
  • Revoke and rotate any credential that has already been built into an image; merely deleting the image tag or changing a later layer is insufficient.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-level description says this skill is a '多智能体编排部署助手' built on AWS Bedrock AgentCore and LangGraph. However, the body repeatedly states that the free version only supports single-agent deployment and explicitly excludes multi-agent orchestration, with the sample code implementing only one agent node and one HTTP entrypoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

bash
agentcore dev  # 启动热重载本地开发服务器
# 另开终端测试
curl -X POST http://localhost:8080/invocations \
  -H "Content-Type: application/json" \
  -d '{"prompt":"你好"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The markdown instructs users to deploy a containerized HTTP service and notes that an HTTPS endpoint will be exposed externally, but it does not prominently warn about network exposure, cloud cost, or resource creation. In an agent skill with exec access, lack of such warnings raises the risk of unintended public exposure or surprise infrastructure changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented destroy command can remove deployed resources, but the file does not warn that it is destructive. In a tool-enabled environment, omission of a deletion warning can lead to accidental teardown of active services or loss of configuration and availability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill uses overly broad scenario keywords and vague applicability text, which can cause an agent platform to invoke it outside its intended scope. In a skill-routing ecosystem, overbroad matching increases the chance of unnecessary command execution, deployment actions, or network-facing setup when the user did not clearly request them.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This example instructs sending prompts to an externally exposed HTTPS endpoint without any warning about transmitting potentially sensitive user input over a remote service. In the context of an agent deployment skill, this encourages outbound data transmission and public endpoint usage without discussing authentication, data handling, or minimization.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

外部调用：

bash
curl -X POST https://配置值/invocations \
  -H "Content-Type: application/json" \
  -d '{"prompt":"这篇关于Kubernetes的文章"}'
# 返回：{"result":"分类结果：技术"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This repeated external curl example again normalizes sending content to a remote HTTPS endpoint without safeguards or disclosure of privacy/security implications. Repetition increases the chance that users copy-paste networked examples into production-like use without considering data exposure or access control.

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

外部调用：

bash
curl -X POST https://配置值/invocations \
  -H "Content-Type: application/json" \
  -d '{"prompt":"这篇关于Kubernetes的文章"}'

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

Line L156 frames the free edition as excluding Gateway/MCP behavior, but elsewhere the skill documents and endorses full deployment lifecycle commands such as configure, launch, and destroy. This creates an intent-level inconsistency in the documentation about whether the skill is merely a local orchestration starter or a full deployment-management assistant affecting live AWS resources.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 358)May include surrounding context.

md
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Static analysis

No suspicious patterns detected.