AWS成本优化入门

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.2

Overview

This AWS cost-analysis skill is not overtly malicious, but it asks for AWS credentialed command execution while using overly broad and inconsistent instructions.

Install only if you want an agent to analyze AWS billing/resource data, and use a dedicated read-only IAM user or profile. Avoid giving it write-capable AWS permissions, review any command before execution, and prefer a pinned dependency setup in a virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:125

Finding

Unpinned Third-Party Dependency Installation Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 125 and 229
Vulnerability Type: Unpinned and unverifiable dependency installation
Risk Level: Medium

Vulnerable code snippet:

bash

pip install boto3

The same installation instruction is repeated in the dependency table:

markdown

| boto3 | Python library | Required | `pip install boto3` |

Technical Analysis

The skill directs users to install boto3 without specifying an audited version, cryptographic hash, lockfile, trusted package index, or isolated environment. Consequently, the package content installed at any given time is mutable and cannot be verified against a reviewed artifact.

Although boto3 is a legitimate package and the audited project contains no evidence that it currently resolves to malicious content, this installation pattern creates a supply-chain exposure. A compromised upstream release, package-index account, index configuration, or network/package-source configuration could cause attacker-controlled code to be installed. Python packages can execute code during installation or when imported at runtime.

Attack Path

1. An attacker compromises the upstream package, its publishing credentials, the configured Python package index, or another dependency in the resolution chain.
2. The attacker publishes a malicious release that remains compatible with the unconstrained installation command.
3. A user follows the skill documentation and runs pip install boto3.
4. pip resolves the mutable latest version and its transitive dependencies without validating them against project-provided hashes.
5. Malicious code executes during installation or when the installed package is subsequently imported.

This path depends on a separate supply-chain or package-source compromise; the audit found no embedded malicious package or active compromise in the project itself.

Impact Assessment

Malicious dependenc ...[truncated 477 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin boto3 and all transitive dependencies to versions that have been reviewed and tested.
2. Generate a lockfile containing cryptographic hashes, such as with pip-tools, and install using hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Install dependencies inside a dedicated virtual environment rather than the system Python environment.
4. Explicitly use an approved HTTPS package index and disable unintended additional indexes to reduce dependency-confusion exposure.
5. Integrate dependency vulnerability and provenance scanning into the release process.
6. Periodically update pinned versions through a controlled review process rather than resolving mutable versions during user installation.
7. Keep AWS credentials restricted to read-only, least-privilege permissions so a compromised dependency cannot modify AWS resources.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger text is overly broad, covering generic data analysis, reporting, statistics, and visualization requests that are common across many unrelated tasks. That increases the risk of inappropriate auto-selection, causing this AWS-focused skill to activate in contexts where executing commands or reading/writing files is unnecessary and potentially unsafe.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description states '支持中文交互' and presents the skill as Chinese-interaction oriented without offering a language choice or documenting a justified locale restriction. This can violate language/locale policy where users should not be forced into a specific language absent opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The core feature banner highlights Chinese interaction as a defining behavior, but the document does not indicate that users can choose another language. This reads as a fixed locale preference rather than an opt-in language option.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises a limited free AWS cost-analysis capability, but its documented workflows include create/query/export and config modify/reset/import actions that materially expand what an agent may attempt to do. This mismatch can cause over-privileged or unintended execution, especially because the skill also declares exec/write tools, making the effective behavior broader than users would reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The capability coverage section lists many ambiguous keywords rather than precise activation conditions, which can make the skill match loosely related prompts. In a skill with exec/read/write capabilities, ambiguous routing increases the attack surface by triggering command-capable behavior outside the narrow AWS cost-optimization context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation claims recommendations are manual-only, but elsewhere describes file writing, external API integration, command execution, and broad retrieval as core functions. In context, this is dangerous because the skill has read/exec/write access and operates against cloud-account data, so overstated capabilities can lead to unexpected file changes, API calls, or command runs beyond a simple advisory tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file says the free version does not support automatic optimization, yet later markets the skill as full-process automation with automated execution and command execution capabilities. These contradictory claims can mislead an agent or user into invoking broader automation than intended, increasing the chance of unsafe command execution or unauthorized changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.