Aws Agentcore Langgr

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.4

Overview

This skill is mostly a deployment guide, but it gives broad cloud deployment and teardown instructions without enough scoping or safeguards.

Review this skill before installing if you do not want an agent giving AWS deployment or cleanup guidance. Use least-privilege AWS credentials, confirm any deploy or destroy command manually, install dependencies in a virtual environment, and avoid invoking it for ordinary AWS questions unrelated to AgentCore and LangGraph.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Executable Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–18
Vulnerability Type: Unpinned third-party packages and CLI tooling
Risk Level: Medium

Vulnerable Code

bash

pip install bedrock-agentcore bedrock-agentcore-starter-toolkit langgraph
uv tool install bedrock-agentcore-starter-toolkit  # installs agentcore CLI

Technical Analysis

The installation instructions retrieve and install executable Python packages without specifying exact versions or verifying package integrity with cryptographic hashes. The installed artifacts and their transitive dependencies can therefore change after the skill has been reviewed.

This prevents reproducible installation and exposes users to supply-chain threats such as a compromised upstream release, compromised maintainer account, malicious transitive dependency, or dependency-resolution manipulation. Installation hooks and subsequently imported package code may execute with the privileges of the user performing the installation.

The audit found no evidence that the named packages are currently malicious. The vulnerability is the unsafe, unpinned installation process.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or the relevant package-publishing account.
2. The attacker publishes a malicious release that remains compatible with the unrestricted dependency specifications.
3. A user follows the documented pip install or uv tool install command.
4. The package manager resolves and downloads the attacker-controlled release.
5. Malicious installation hooks, CLI code, or imported runtime code executes under the installing user's account.
6. The payload may access files and credentials available to that account or manipulate later AWS deployment activity.

Impact Assessment

Successful exploitation can provide code execution with the privileges of the user who installs or runs the packages. The accessible scope may include project files, e ...[truncated 301 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to an exact, reviewed version.
• Generate and distribute a lock file that also constrains transitive dependencies.
• Require cryptographic hashes during installation, such as with pip install --require-hashes -r requirements.txt.
• Configure an explicit trusted package index or an internally controlled package mirror.
• Install dependencies in a dedicated virtual environment or other isolated environment rather than into a privileged or system-wide interpreter.
• Review package provenance, release signatures where available, maintainers, and transitive dependency changes before updating.
• Test upgrades in a restricted environment before approving and updating the lock file.
• Avoid running package installation commands with administrator or root privileges.
• Use least-privilege AWS credentials when running the installed deployment tooling.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest exposes only a read tool, but the documentation directs users to perform AWS deployments, teardown, and memory/gateway operations that are write-capable and potentially destructive. This mismatch weakens user and platform expectations, encouraging execution of higher-risk cloud actions outside the declared capability boundary and increasing the chance of unsafe invocation or policy bypass.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

| `Model use case details not submitted` | Fill  form in Bedrock Console |
| `Invalid agent name` | Use underscores not hyphens |
| Memory empty after write | Wait ~10s (eventual consistency) |
| Container not reading .env | Set ENV in Dockerfile, not .env |
| Memory not working after deploy | Check logs for "Memory enabled/disabled" |
| `list_events` returns empty | Check actor_id/session_id match; `event['payload']` is a list |
| Gateway "Unknown tool" | Lambda must strip `___` prefix from `bedrockAgentCoreToolName` |

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger keywords are extremely broad, including generic terms like 'aws' and 'skill', which can cause the skill to activate for unrelated requests. In a skill that discusses deployment, command execution, and cloud operations, over-broad activation materially raises the risk of unintended guidance or actions in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description claims applicability across many scenarios without defining firm boundaries, which makes it unclear when the skill should or should not be used. This ambiguity is risky because the content includes cloud deployment and execution guidance that should only apply in tightly scoped contexts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that no extra API key is needed, but later says some functions do require API keys. Inconsistent credential guidance can cause users to mis-handle secrets, attempt insecure workarounds, or misunderstand when authenticated external access is occurring.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The summary and description combine Chinese and English, and the document continues with mixed-language guidance, but there is no statement that the user can choose their preferred language. This can violate language/locale policy expectations when a skill implicitly forces or defaults to a language pattern without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.