Security audit
Security checks for vulnerabilities and agentic risk
This AWS inspection skill is not malicious, but it needs review because it advertises read-only use while also allowing cloud changes through command execution.
Install only if you intend an agent to run AWS CLI commands in your environment. Use a least-privilege read-only IAM profile, specify profile and region explicitly, do not allow the agent to open or print credential files, and treat any create, modify, delete, terminate, scale, IAM, or billing command as outside the advertised read-only purpose unless you deliberately approve it.
The skill is marketed as a read-only/free inspection assistant, but the content explicitly allows resource-changing operations after confirmation. This mismatch can mislead users or an invoking agent into granting broader trust or permissions than intended, increasing the chance of unsafe execution in a cloud environment where write operations can be destructive or costly.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
AWS CLI标准配置路径：
~/.aws/config（profile与region配置）、~/.aws/credentials（访问密钥）%USERPROFILE%\.aws\config、%USERPROFILE%\.aws\credentialsThe document includes an example of the ~/.aws/credentials file format with access key fields. Even with redacted placeholder values, embedding credential-file content patterns in a tool-enabled skill normalizes direct credential handling and increases the chance an agent will inspect, request, or expose real secrets during troubleshooting.
output = table
`~/.aws/credentials` 文件示例：
```ini
[default]
aws_access_key_id = AKIA...
The troubleshooting advice explicitly tells the user/agent to check ~/.aws/credentials and suggests setting raw credential environment variables. In an agent context, this can prompt exposure of secrets in command history, logs, terminal output, or model context, directly increasing credential-compromise risk.
A：可以，但所有变更类操作（delete/terminate/modify等）必须经过用户二次确认。本Skill会先展示完整命令与 `--dry-run` 预演结果，用户确认后才执行。完整变更管理（变更追踪、回滚、审批流）是专业版能力。
### Q4：报错 "Unable to locate credentials" 怎么办？
A：运行 `aws configure` 配置访问密钥，或检查 `~/.aws/credentials` 文件是否存在且格式正确。也可通过环境变量 `AWS_ACCESS_KEY_ID` 与 `AWS_SECRET_ACCESS_KEY` 临时设置。
### Q5：如何只查询特定状态的EC2实例？
A：使用 `--filters` 参数。例如：
The error-handling table instructs checking the credential file as a remediation step. In a tool-using agent, troubleshooting steps often become executable actions, so this guidance can lead to secret-bearing file access contrary to the claimed safety model.
| 序号 | 问题 | 原因 | 修复方案 | 优先级 |
|------|------|------|----------|--------|
| 1 | `Unable to locate credentials` | 未配置AWS凭证 | 运行 `aws configure` 或检查 `~/.aws/credentials` | P0 |
| 2 | `InvalidClientTokenId` | 凭证无效或已过期 | 重新生成access key并更新配置 | P0 |
| 3 | `AccessDenied` | IAM权限不足 | 联系管理员添加所需权限，或切换有权限的profile | P1 |
| 4 | `Could not connect to the endpoint URL` | 网络问题或region错误 | 执行ping命令测试网络连通性,检查防火墙和代理设置代理设置，确认region拼写正确 | P1 |
The skill first establishes a read-only safety boundary, then later states it supports create/modify/delete-style operations. This internal contradiction can cause an agent to overreach from audit tasks into state-changing actions, especially if downstream orchestration relies on the 'read-only' claim for trust decisions.
The document claims it will never read or output credential file contents, yet elsewhere instructs checking credential files and even presents their structure. In an agent setting, contradictory guidance around secrets handling weakens safety guarantees and can lead the model to inspect or expose credential-bearing files during troubleshooting.
The trigger scope includes broad development and help-oriented language unrelated to narrowly scoped AWS read-only inspection. Overbroad invocation criteria can cause the skill to activate in contexts where cloud credentials are available but the user did not intend cloud inspection, increasing accidental command execution and data exposure risk.
The file states '重写为中文文档', and the entire skill is presented only in Chinese with no indication that the user may choose another language. This can violate language/locale policy when a skill imposes a specific language without offering an explicit user choice or documenting a justified locale constraint.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
No suspicious patterns detected.