Aws Agentcore Langgr

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 1.0.3

Overview

This is a documentation-style AWS deployment helper, but it needs Review because it can lead an agent to install packages and change or delete cloud resources despite declaring only read access.

Install only if you intend to use it for AWS Bedrock AgentCore and LangGraph deployment work. Review every command before execution, especially launch, gateway deploy, memory writes, and destroy; use a virtual environment, pin dependencies, keep secrets out of the install step, and use least-privilege AWS credentials in a sandbox account where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Dependencies Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–22
Vulnerability Type: Unverified and unpinned third-party package installation
Risk Level: Medium

Vulnerable Code Snippet

bash

pip install bedrock-agentcore bedrock-agentcore-starter-toolkit langgraph
uv tool install bedrock-agentcore-starter-toolkit  # installs agentcore CLI

Technical Analysis

The installation instructions retrieve and install the latest available versions of several third-party packages without version constraints, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, the installed dependency graph can change after the skill has been reviewed.

Python package installation can run package build or installation logic, while subsequently importing or invoking the packages executes their runtime code. If a named package or one of its transitive dependencies is compromised, replaced, or resolves from an attacker-controlled package source, following these instructions can cause attacker-supplied code to execute with the privileges of the user running pip or uv.

The audited file does not itself retrieve a known malicious package, and no malicious payload is embedded in the project. The risk arises from the lack of dependency pinning and integrity verification.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or a package source used by the victim.
2. The attacker publishes a malicious release or causes dependency resolution to select an attacker-controlled artifact.
3. A user or agent follows the documented pip install or uv tool install command.
4. The package manager downloads the unverified artifact because no reviewed version or hash is enforced.
5. Malicious code executes during installation or when the installed library or agentcore command is subsequently imported or invoked.
6. The payload operates with the invoking user ...[truncated 847 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a specifically reviewed version rather than resolving the latest release.
2. Generate and commit a lockfile that includes the complete transitive dependency graph.
3. Require cryptographic hashes for downloaded artifacts, such as with pip --require-hashes and a hash-pinned requirements file.
4. Configure package installation to use an explicitly trusted index and prevent unintended fallback to untrusted or private indexes.
5. Verify package provenance, maintainer identity, release signatures, and artifact checksums before approving upgrades.
6. Install dependencies in a dedicated virtual environment or disposable sandbox using an unprivileged account.
7. Keep AWS credentials and other secrets unavailable during dependency installation. Grant credentials only when needed at runtime and apply least-privilege IAM policies.
8. Introduce automated dependency and supply-chain scanning, and review lockfile changes before accepting package updates.

Example hardened installation pattern:

bash

python -m venv .venv
. .venv/bin/activate
python -m pip install --index-url https://pypi.org/simple \
  --require-hashes -r requirements.lock

The referenced requirements.lock should contain reviewed, exact versions and hashes for all direct and transitive dependencies.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Scope Creep

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest declares only a read tool, but the skill content instructs users to perform deployment, memory writes, gateway deployment, and destruction operations. This capability mismatch can mislead users or downstream policy systems into granting trust based on an understated risk profile, increasing the chance of unsafe cloud write/destructive actions being invoked under a seemingly low-risk skill.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

| `Model use case details not submitted` | Fill  form in Bedrock Console |
| `Invalid agent name` | Use underscores not hyphens |
| Memory empty after write | Wait ~10s (eventual consistency) |
| Container not reading .env | Set ENV in Dockerfile, not .env |
| Memory not working after deploy | Check logs for "Memory enabled/disabled" |
| `list_events` returns empty | Check actor_id/session_id match; `event['payload']` is a list |
| Gateway "Unknown tool" | Lambda must strip `___` prefix from `bedrockAgentCoreToolName` |

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger keywords include very broad terms like aws, coherent, and skill, which can cause the skill to activate in unrelated contexts. Because this skill documents cloud deployment, gateway setup, command execution, and destructive cleanup, overbroad activation increases the risk of accidental exposure to hazardous operational instructions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description frames the skill as a lightweight deployment helper, while the body includes materially broader operational actions such as persistent memory writes, gateway deployment, and infrastructure cleanup. This understates operational scope and can cause users to invoke powerful cloud-affecting workflows without appreciating the full blast radius.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The summary and description present content in Chinese and English, but the file does not state that the user can choose their preferred language or locale. This can create a language-policy issue if the skill defaults to mixed-language output without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill says no extra API key is needed, but elsewhere says some functions do require platform API keys and environment-variable configuration. Contradictory credential guidance can lead users to mishandle secrets, improvise insecure storage, or misunderstand which operations authenticate against external services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.