aws-graph-agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.4

Overview

This is mostly an AWS agent-deployment guide, but it needs review because it combines cloud deployment, command execution, persistent memory, and risky secret-handling guidance without tight user-control boundaries.

Review this skill before installing in a real AWS environment. Use it only with a least-privilege development account, require explicit approval before any deploy, destroy, write, or command step, disable persistent memory unless needed, inject secrets at runtime through a secret manager or orchestrator secret mechanism, and pin dependencies before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:115

Finding

Unpinned Third-Party Dependencies Permit Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 115-119
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

bash

pip install bedrock-agentcore bedrock-agentcore-starter-toolkit langgraph
uv tool install bedrock-agentcore-starter-toolkit

Technical Analysis

The installation instructions retrieve executable Python packages from external registries without specifying exact versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Package installation may execute package-controlled build or installation logic under the privileges of the user running the command.

Because dependency resolution is not reproducible, the code installed during a future invocation may differ from the code available when this skill was audited. A compromised upstream release, malicious transitive dependency, dependency-confusion condition, or unexpected incompatible release could therefore introduce arbitrary executable behavior.

Attack Path

1. An attacker compromises an upstream package, its publishing credentials, or one of its unpinned transitive dependencies.
2. The attacker publishes a malicious release that satisfies the unrestricted dependency requirement.
3. A user follows the documented pip install or uv tool install instructions.
4. The package manager resolves and downloads the attacker-controlled release.
5. Malicious package code executes during installation or when the installed CLI or library is subsequently used.

Impact Assessment

Exploitation could execute arbitrary code with the privileges of the account performing installation or running the installed tools. Depending on that account's environment, the compromised package could access local files, environment variables, API keys, AWS credentials, source repositories, CI/CD credentials, or cloud deployment permissions. The affected scope includes the developer workstation, ...[truncated 71 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed, exact version.
• Generate and commit a lockfile that also fixes transitive dependency versions.
• Require cryptographic package hashes where the package manager supports them.
• Configure an explicitly trusted package index or an internally controlled artifact repository.
• Run dependency vulnerability, provenance, and license scanning in CI.
• Review and test dependency updates before modifying the lockfile.
• Perform package installation in an isolated, least-privileged environment without production credentials.
• Prefer reproducible deployment artifacts rather than resolving unrestricted dependencies during production deployment.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:127

Finding

Dockerfile Environment Variable Guidance Can Bake Secrets into Container Images

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 127-132; repeated at lines 327-329
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable guidance, translated into English from the source:

text

Set environment variables in the container using Dockerfile ENV, not .env.

The document later repeats the recommendation:

text

Use an ENV instruction in the Dockerfile to set environment variables.

Technical Analysis

The skill requires API-key configuration and recommends placing container environment configuration in Dockerfile ENV instructions. If a user applies this guidance to API keys, AWS credentials, tokens, or other sensitive values, those secrets can become part of the image configuration or image layers.

Secrets embedded during image construction may remain recoverable even when later instructions overwrite or remove them. They can also be exposed through source control, build logs, build cache, image inspection, container registries, exported images, or derivative images. Environment-variable names and non-sensitive defaults may be declared in a Dockerfile, but secret values must not be baked into an image.

Attack Path

1. A user follows the skill's API-key and Dockerfile configuration guidance.
2. The user adds an instruction such as ENV API_KEY=... containing a real secret.
3. The Dockerfile is committed, or the image is built and pushed to a registry.
4. An attacker with access to the repository, build cache, registry, image archive, or image metadata inspects the Dockerfile or container image.
5. The attacker extracts the credential and uses it against the associated API or AWS environment.

Impact Assessment

The direct impact is disclosure of any credential embedded in the Dockerfile or image. The privileges obtained are those granted to the exposed credential. Depending on its permissions, this could enable unauthori ...[truncated 289 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the Dockerfile ENV recommendation with runtime secret injection.
• Use AWS Secrets Manager or AWS Systems Manager Parameter Store for AWS deployments.
• Use the container orchestrator's secret-management mechanism or read-only secret mounts.
• Pass secrets only when starting the container and avoid recording them in shell history, deployment logs, or committed configuration.
• Restrict secret access through least-privilege IAM policies and workload identities.
• Use short-lived credentials instead of static API keys wherever supported.
• Add secret scanning for source repositories, Dockerfiles, CI logs, and built container images.
• Rotate any credential that has previously been embedded in a Dockerfile or image.
• Document that Dockerfile ENV may be used only for non-sensitive defaults and configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

| 推理配置 | 使用 `us.anthropic.claude-*` 推理配置文件 | `on-demand throughput isn't supported` |
| 代理命名 | 字母开头，仅字母/数字/下划线，1-48 字符 | `Invalid agent name` |
| 区域选择 | 选择支持 AgentCore 的区域（如 us-east-1） | 部署失败 |
| 环境变量 | 容器中在 Dockerfile 设置 ENV，非 .env | 容器不读取 .env |
| 记忆开关 | 确认是否需要记忆子系统 | 记忆功能不可用 |

### Step 3: 编写代理代码（StateGraph + Runtime）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md

| 推理配置 | 使用 `us.anthropic.claude-*` 推理配置文件 | `on-demand throughput isn't supported` |
| 代理命名 | 字母开头，仅字母/数字/下划线，1-48 字符 | `Invalid agent name` |
| 区域选择 | 选择支持 AgentCore 的区域（如 us-east-1） | 部署失败 |
| 环境变量 | 容器中在 Dockerfile 设置 ENV，非 .env | 容器不读取 .env |
| 记忆开关 | 确认是否需要记忆子系统 | 记忆功能不可用 |

### Step 3: 编写代理代码（StateGraph + Runtime）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

md

| 推理配置 | 使用 `us.anthropic.claude-*` 推理配置文件 | `on-demand throughput isn't supported` |
| 代理命名 | 字母开头，仅字母/数字/下划线，1-48 字符 | `Invalid agent name` |
| 区域选择 | 选择支持 AgentCore 的区域（如 us-east-1） | 部署失败 |
| 环境变量 | 容器中在 Dockerfile 设置 ENV，非 .env | 容器不读取 .env |
| 记忆开关 | 确认是否需要记忆子系统 | 记忆功能不可用 |

### Step 3: 编写代理代码（StateGraph + Runtime）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

md

| 推理配置 | 使用 `us.anthropic.claude-*` 推理配置文件 | `on-demand throughput isn't supported` |
| 代理命名 | 字母开头，仅字母/数字/下划线，1-48 字符 | `Invalid agent name` |
| 区域选择 | 选择支持 AgentCore 的区域（如 us-east-1） | 部署失败 |
| 环境变量 | 容器中在 Dockerfile 设置 ENV，非 .env | 容器不读取 .env |
| 记忆开关 | 确认是否需要记忆子系统 | 记忆功能不可用 |

### Step 3: 编写代理代码（StateGraph + Runtime）

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill declares command execution, file writes, and external API integration without an upfront warning that these are high-impact operations. In the context of an agent skill intended for broad agent platforms, users or orchestrators may invoke it without understanding that it can change local state, call external services, or deploy cloud resources, creating meaningful risk of unintended modification, cost incurrence, or data exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

L047-L054 的“高清分辨率与无损输出”“批量生成与风格预设”“自定义模型微调”“商用版权授权”等内容属于图像/内容生成产品的营销文案，与本文件其余部分声明的 AWS Bedrock AgentCore、LangGraph、多代理编排、Memory、Gateway、CLI 部署工具完全不一致。这不是单纯信息缺失，而是文档内容主动描述了另一类能力，造成开发者意图与技能实际用途相矛盾。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation guidance is so broad that a host agent may activate this skill for vague requests without clear user intent or scope boundaries. In a skill that advertises exec, write, deployment, and external API integration, ambiguous triggering increases the chance of unintended impactful actions such as launching services, modifying files, or invoking cloud operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L364-L369 的“功能矩阵”声称该技能支持多种文件格式读取/解析/写入、信息检索、命令执行沙箱等通用能力，但本文件主体描述的核心实现始终围绕 StateGraph、Runtime HTTP、Memory、Gateway 和 agentcore CLI。将通用文件处理与检索写成功能，会让使用者误以为该技能本身实现了这些能力，而这并未在其主要实现说明中得到支撑。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

前文 L146-L151 的 Runtime 示例返回的是简单的 {"result": ...} 风格，而 L316-L334 又声明统一输出包含 success、data、execution_log、processor 等通用包装结构。该结果格式并未对应前文代理 Runtime 代码路径，文档对调用者形成了与实际实现不一致的接口预期。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

L384-L393 量化了“文件解析与提取”“批量文件处理”“命令执行与结果收集”等效率收益，但本文档前面的实现示例并未展示文件处理流水线，而是专注于 AWS AgentCore/LangGraph 编排与部署。这样的性能声明把技能包装成通用自动化工具，超出了清晰声明的多代理部署编排用途。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.