AWS图代理

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.4

Overview

The skill is mostly a coherent AWS AgentCore/LangGraph deployment guide, but its activation scope and permissions are broader than its stated purpose warrants.

Install only if you intend to use AWS Bedrock AgentCore/LangGraph workflows. Keep AWS credentials least-privileged, avoid pasting secrets into chat, pin dependencies where possible, use an isolated environment, and manually review any install, launch, destroy, or production Gateway/Lambda command before running it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:96

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 96-97 and 271-275
Vulnerability Type: Unpinned package installation from mutable third-party repositories
Risk Level: Medium

Vulnerable Code Snippet

bash

pip install bedrock-agentcore bedrock-agentcore-starter-toolkit langgraph
uv tool install bedrock-agentcore-starter-toolkit

The dependency table at lines 271-275 also recommends installing the same packages, as well as uv, without version or integrity constraints:

bash

pip install bedrock-agentcore
pip install bedrock-agentcore-starter-toolkit
pip install langgraph
pip install uv

Technical Analysis

The documented installation commands resolve mutable package names without exact version constraints, cryptographic hashes, a lock file, or an explicitly trusted package index. Consequently, the code installed when a user follows these instructions may differ from the dependencies that existed when the Skill was audited.

Python packages and their transitive dependencies can execute package-controlled code during installation or later when imported. If a package publisher account, release pipeline, package repository, or transitive dependency is compromised, following these commands may execute attacker-controlled code with the permissions of the user running the installer.

No malicious package is proven to be present. The vulnerability is the absence of controls that would provide reproducible and integrity-verified dependency resolution.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or its package-publishing account.
2. The attacker publishes a malicious release under the package name accepted by the unpinned command.
3. A user follows the Skill documentation and executes pip install or uv tool install.
4. The resolver selects the malicious or unexpectedly modified release.
5. Package installation logic or impo ...[truncated 790 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version.
2. Maintain a lock file that also constrains transitive dependencies.
3. Require cryptographic hashes, such as through a hash-locked requirements file and pip --require-hashes.
4. Configure an explicitly trusted package index and prevent unintended fallback to extra indexes.
5. Install dependencies in an isolated virtual environment or disposable build container using an unprivileged account.
6. Scan resolved packages and container images for known vulnerabilities before deployment.
7. Establish a controlled dependency-update process that reviews release changes and regenerates hashes.
8. Avoid exposing AWS credentials to package installation processes. Prefer short-lived, least-privilege roles during subsequent deployment operations.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:359

Finding

Generic Administrator Execution Guidance Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 359
Vulnerability Type: Unnecessary privilege-escalation recommendation
Risk Level: Low

Vulnerable Documentation Snippet

The troubleshooting table provides the following guidance:

text

Insufficient permissions | The current user lacks read/write permission | Check file permissions and run as administrator

Technical Analysis

The guidance recommends administrator execution as a generic response to file permission failures. It does not first identify the affected resource, determine whether access is legitimately required, constrain the elevated operation, or require correction of narrowly scoped ownership and permissions.

Permission errors are security boundaries rather than merely operational obstacles. Rerunning package installation, generated agent code, or deployment tooling with administrative privileges increases the authority available to all code loaded by that operation, including third-party dependencies and transitive subprocesses.

The document does not itself execute an elevation command, and no automatic privilege-escalation mechanism was found. The risk arises when a user follows the recommendation.

Attack Path

1. A package installation, generated script, or deployment command encounters a permission error.
2. The user follows the troubleshooting recommendation and reruns the operation as an administrator.
3. The elevated operation loads third-party packages, project-generated code, plugins, or subprocesses.
4. A compromised dependency or defective command executes with elevated privileges.
5. The process can modify resources that were protected from the original unprivileged account.

Impact Assessment

The recommendation may expand a process from ordinary user access to administrative access. Depending on the operating system and elevated command, this could permit modification of system-wide package locations ...[truncated 293 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the blanket recommendation to run operations as an administrator.
2. Instruct users to identify the exact inaccessible file or directory and verify that access is legitimately required.
3. Correct ownership or permissions only on the specific resource, granting the minimum necessary access.
4. Use per-user virtual environments and user-owned project directories for Python dependencies.
5. If elevation is unavoidable, document the exact reviewed command and explain why elevated access is necessary.
6. Never combine privilege elevation with unpinned package installation or unreviewed generated code.
7. Run deployment tooling in an isolated environment with narrowly scoped filesystem and cloud permissions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

| 推理配置 | 使用 `us..-*` 推理配置文件 | `on-demand throughput isn't supported` |
| 代理命名 | 字母开头，仅字母/数字/下划线，1-48 字符 | `Invalid agent name` |
| 区域选择 | 选择支持 AgentCore 的区域（如 us-east-1） | 部署失败 |
| 环境变量 | 容器中在 Dockerfile 设置 ENV，非 .env | 容器不读取 .env |
| 记忆开关 | 确认是否需要记忆子系统 | 记忆功能不可用 |

### Step 3：编写代理代码（StateGraph + Runtime）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

md

| 推理配置 | 使用 `us..-*` 推理配置文件 | `on-demand throughput isn't supported` |
| 代理命名 | 字母开头，仅字母/数字/下划线，1-48 字符 | `Invalid agent name` |
| 区域选择 | 选择支持 AgentCore 的区域（如 us-east-1） | 部署失败 |
| 环境变量 | 容器中在 Dockerfile 设置 ENV，非 .env | 容器不读取 .env |
| 记忆开关 | 确认是否需要记忆子系统 | 记忆功能不可用 |

### Step 3：编写代理代码（StateGraph + Runtime）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

md

| 推理配置 | 使用 `us..-*` 推理配置文件 | `on-demand throughput isn't supported` |
| 代理命名 | 字母开头，仅字母/数字/下划线，1-48 字符 | `Invalid agent name` |
| 区域选择 | 选择支持 AgentCore 的区域（如 us-east-1） | 部署失败 |
| 环境变量 | 容器中在 Dockerfile 设置 ENV，非 .env | 容器不读取 .env |
| 记忆开关 | 确认是否需要记忆子系统 | 记忆功能不可用 |

### Step 3：编写代理代码（StateGraph + Runtime）

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation description is overly broad, covering generic coding, debugging, testing, deployment, and development scenarios. In a skill with Read, Write, Edit, and Bash access, vague triggering criteria can cause the skill to activate in unrelated contexts and execute higher-risk operations with insufficient user intent verification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The supported-scene keywords are vague, expansive, and loosely tied to almost any cloud or multi-agent development request. Because the skill includes filesystem and shell capabilities, this ambiguity increases the chance of over-activation and unnecessary exposure to sensitive code, credentials, or infrastructure operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

At L257, the code sets mode = "production" but the adjacent comment labels the first quoted option as local development, creating a direct contradiction between documentation and the value actually used. This can mislead a user into believing the snippet demonstrates a local-safe mock path when it actually configures production gateway mode.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.