Security audit

AWS云架构师

Security checks for vulnerabilities and agentic risk

Overview

This Markdown-only skill helps an agent use local AWS CLI credentials for AWS audits and administration, with no hidden install code found, but users should restrict AWS permissions carefully.

Use this skill with a least-privilege AWS profile, preferably read-only by default. Review every generated AWS CLI command before it runs, require explicit confirmation for any create, modify, delete, IAM, billing, or credential-related action, and avoid callback_url unless the endpoint and transmitted data are trusted. Do not paste AWS access keys or session tokens into chat.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest scopes the skill to security/compliance use cases, but the body authorizes broader AWS administration such as inventory, monitoring, and cost operations. This scope mismatch can cause users or orchestration systems to invoke the skill in contexts with more privilege or broader authority than its declared purpose justifies.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill advertises 'default read-only' behavior, yet it documents concrete write, sensitive, and destructive actions including creation of access keys and deletion-oriented workflows. This creates a dangerous trust mismatch: users or agents may grant or use the skill assuming safe read-only behavior when it can facilitate state-changing operations.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The inclusion of a generic callback URL and external integration behavior is not necessary for a local AWS CLI helper and introduces an unnecessary data egress path. AWS inventory, account identifiers, security findings, or operational details could be transmitted to external systems without clear scoping, trust requirements, or restrictions.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The skill claims strict zero-exposure handling for AWS credentials, but later guidance introduces generic API key configuration and API connection setup unrelated to the AWS CLI use case. This inconsistency weakens operator expectations and can lead to unnecessary credential collection, storage, or confusion about what secrets the skill may access.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document claims only pre-approved commands are allowed and that user input is not concatenated into parameters, but the skill is described as natural-language-driven with broad command execution and no enforceable allowlist. That mismatch can enable unsafe command construction, privilege expansion, or accidental execution of commands outside the intended AWS audit scope.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The callback URL feature lacks a clear warning that AWS-related results may be sent to external systems. In a cloud-architecture skill, outputs can include account IDs, bucket names, IAM data, network exposure findings, and other sensitive metadata, so silent or poorly documented exfiltration risk is significant.

Static analysis

No suspicious patterns detected.