ClawHub
Back to skill

Security audit

Aws Cloud Architect Free

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly an AWS architecture helper, but it presents real AWS infrastructure-changing commands inside a supposedly read-only/free workflow.

Review this skill carefully before installing. It is not clearly limited to read-only AWS inventory: only use it in accounts where the agent cannot make unintended changes, and require explicit human approval before any AWS command that creates, modifies, deletes, terminates, or changes retention/configuration.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill repeatedly claims that commands are read-only by default, but the same section includes write operations such as creating VPC endpoints and changing CloudWatch Logs retention. In an agent with exec capability, this mismatch can cause users or downstream automation to treat mutating commands as safe reconnaissance, leading to unintended infrastructure changes and cost/security impact.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The file says the free skill does not include IaC/template generation or advanced provisioning, yet the MVP example directly launches EC2, creates an RDS instance, and creates a VPC endpoint. This is dangerous because it normalizes direct infrastructure creation inside a supposedly advisory/read-only skill, increasing the chance of accidental deployment, unexpected billing, and insecure default builds.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The documentation states that all commands are read-only by default, but nearby examples include `create-vpc-endpoint` and `put-retention-policy`, both of which mutate AWS state. This contradiction is especially risky in a skill exposing `exec`, because the safety boundary described to the user is false and may lead to trust-based execution of state-changing commands.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The example presented for MVP architecture selection performs real resource creation despite the skill's stated read-only and non-provisioning positioning. In context, this makes the skill more dangerous because the examples are concrete, copy-pastable AWS CLI commands that can immediately incur charges and create public or misconfigured resources if run unreviewed.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.