Security audit

AWS成本优化入门

Security checks for vulnerabilities and agentic risk

Overview

The skill is an AWS cost-analysis helper, but it asks for sensitive AWS access and command execution while using overly broad and inconsistent instructions.

Install only if you are comfortable giving an agent access to AWS billing data and local command execution. Use a read-only IAM user limited to Cost Explorer and related describe/list permissions, avoid long-lived root or admin credentials, and treat any requested modify/reset/import or non-AWS data-analysis action as outside the reviewed safe scope.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a basic AWS cost-analysis tool, but the documentation expands its behavior to create/query/export operations and modify/reset/import configuration. This creates scope drift that can mislead an agent into performing state-changing or file-affecting actions beyond the user’s expected read-only analysis workflow.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The later sections claim broad capabilities such as generic file handling, API integration, and command execution that materially exceed the stated purpose of AWS cost reporting. Such overbroad claims can cause unintended invocation and widen the operational surface for misuse, including arbitrary command or file operations under the guise of a cost tool.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Declaring write access for a tool whose stated purpose is basic AWS cost analysis violates least privilege. Even if intended only for report export, write capability increases the chance of unauthorized file creation or modification, especially when paired with exec and ambiguous documentation.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documentation states that free mode does not support automatic optimization, yet elsewhere advertises automated execution and full-process automation. This inconsistency can mislead users or agents about whether the skill may take action versus only produce recommendations, increasing the risk of unintended operational changes.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill description uses very broad trigger phrases like data analysis, report generation, statistics, and visualization, which overlap with many unrelated requests. This can cause accidental or opportunistic activation outside the intended AWS cost domain, exposing credentials, tools, or execution paths unnecessarily.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The capability-coverage section lists broad keyword buckets rather than precise activation constraints. Ambiguous matching logic increases the chance that the skill will be selected for unrelated tasks and then use exec/read/write capabilities in contexts the user did not intend.

Static analysis

No suspicious patterns detected.