ClawHub
Back to skill

Security audit

Aws Agentcore Langgr

Security checks for vulnerabilities and agentic risk

Overview

This is mostly an AWS deployment guide, but it under-discloses command and cloud-changing authority and uses overly broad activation terms.

Review this before installing. Use it only with explicit user approval for each package install, AWS deploy, gateway deploy, memory write, or destroy command. Prefer a least-privilege AWS profile, a test account or isolated region, and avoid storing secrets or sensitive customer data in AgentCore memory unless you have a clear retention policy.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The manifest declares only a read tool, but the body of the skill instructs users to configure, launch, and destroy AWS AgentCore deployments. That mismatch can bypass user expectations and policy gating by making cloud-write and destructive operations appear safer or more limited than they are.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The skill first says no extra API key is needed, but later states some features require API keys and environment-variable configuration. This inconsistency can mislead operators about credential handling requirements and cause insecure ad hoc secret setup or accidental credential exposure during use.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The document advertises generic command-execution ability beyond the stated deployment-assistant purpose. In skill ecosystems, hidden or under-declared execution capability is dangerous because it can be used to trigger unexpected system or cloud actions under a benign-looking label.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The document advertises generic command-execution ability beyond the stated deployment-assistant purpose. In skill ecosystems, hidden or under-declared execution capability is dangerous because it can be used to trigger unexpected system or cloud actions under a benign-looking label.

Vague Triggers

High
Confidence
93% confidence
Finding
The trigger keywords include broad terms like 'aws', 'coherent', and 'skill', which can cause the skill to activate in many unrelated contexts. Because this skill discusses deployment, command execution, and cloud operations, overbroad triggering increases the chance of accidental invocation of risky workflows.

Static analysis

No suspicious patterns detected.