ClawHub
Back to skill

Security audit

aws-graph-agent

Security checks for vulnerabilities and agentic risk

Overview

This AWS deployment skill is mostly coherent, but it gives risky, under-scoped guidance for cloud resource deletion and secret handling.

Review the commands before running them against an AWS account. Do not put API keys or other secrets in Dockerfile ENV instructions; use runtime secret injection or an AWS secret store instead. Treat agentcore destroy as a destructive cleanup command and confirm the target environment before using it.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill instructs users to run a destructive cleanup command (`agentcore destroy`) to avoid charges, but does not clearly warn that this can remove deployed resources and associated state. In an agent context with `exec` capability, ambiguous destructive guidance increases the risk of accidental data loss or service disruption if invoked automatically or by an unsuspecting user.

Credential Access

High
Category
Privilege Escalation
Content
| 模型审批未提交 | `Model use case details not submitted` | 未在 Bedrock Console 填写使用表单 | 进入 Bedrock Console 填写 Anthropic 模型使用审批表单 |
| 代理名称无效 | `Invalid agent name` | 名称含连字符或非法字符 | 改用下划线，字母开头，1-48 字符（如 `my-agent` → `my_agent`） |
| 记忆写入后为空 | `list_events` 返回空列表 | 最终一致性延迟约 10s | 等待 10s 后重新查询；检查日志 "Memory enabled/disabled" |
| 容器不读取 .env | 环境变量未生效 | 容器模式不支持 .env 文件 | 在 Dockerfile 中用 `ENV` 指令设置环境变量 |
| 部署后记忆不可用 | 记忆功能缺失 | 部署时使用了 `--disable-memory` | 重新部署不带 `--disable-memory` 参数 |
| actor_id 不匹配 | `list_events` 返回空但记忆已写入 | actor_id/session_id 与写入时不一致 | 确认 ID 匹配，注意 payload 是列表类型 |
| Gateway 未知工具 | `Unknown tool` | Lambda 未去除工具名前缀 | 从 `bedrockAgentCoreToolName` 去除 `___` 前缀 |
Confidence
78% confidence
Finding
Although flagged for credential access incorrectly, the advice to set environment variables in the Dockerfile can lead users to bake secrets into container images, where they may be recoverable from image history, registries, or runtime inspection. In a deployment-oriented skill handling API keys, this context makes the guidance materially risky even if not malicious.

Credential Access

High
Category
Privilege Escalation
Content
| 模型审批未提交 | `Model use case details not submitted` | 未在 Bedrock Console 填写使用表单 | 进入 Bedrock Console 填写 Anthropic 模型使用审批表单 |
| 代理名称无效 | `Invalid agent name` | 名称含连字符或非法字符 | 改用下划线，字母开头，1-48 字符（如 `my-agent` → `my_agent`） |
| 记忆写入后为空 | `list_events` 返回空列表 | 最终一致性延迟约 10s | 等待 10s 后重新查询；检查日志 "Memory enabled/disabled" |
| 容器不读取 .env | 环境变量未生效 | 容器模式不支持 .env 文件 | 在 Dockerfile 中用 `ENV` 指令设置环境变量 |
| 部署后记忆不可用 | 记忆功能缺失 | 部署时使用了 `--disable-memory` | 重新部署不带 `--disable-memory` 参数 |
| actor_id 不匹配 | `list_events` 返回空但记忆已写入 | actor_id/session_id 与写入时不一致 | 确认 ID 匹配，注意 payload 是列表类型 |
| Gateway 未知工具 | `Unknown tool` | Lambda 未去除工具名前缀 | 从 `bedrockAgentCoreToolName` 去除 `___` 前缀 |
Confidence
78% confidence
Finding
Although flagged for credential access incorrectly, the advice to set environment variables in the Dockerfile can lead users to bake secrets into container images, where they may be recoverable from image history, registries, or runtime inspection. In a deployment-oriented skill handling API keys, this context makes the guidance materially risky even if not malicious.

Credential Access

High
Category
Privilege Escalation
Content
### Q1: 部署后记忆为空怎么办？
A: 记忆写入后有约 10 秒最终一致性延迟。等待 10 秒后用 `list_events` 重新查询。如仍为空，检查日志中是否显示 "Memory enabled"，确认部署时未使用 `--disable-memory`.
### Q2: 容器无法读取 .env 文件怎么办？
A: 容器模式下 .env 文件不会被自动读取。在 Dockerfile 中使用 `ENV` 指令设置环境变量，而非依赖 .env 文件。这是容器模式与本地开发习惯的主要差异.
### Q3: 收到 "on-demand throughput isn't supported" 错误？
A: 使用 `us.anthropic.claude-*` 推理配置文件替代按需吞吐量。这是区域和模型组合的限制，跨区域推理配置文件可自动路由到容量充足的区域.
### Q4: 代理名称无效如何修改？
Confidence
77% confidence
Finding
As with the earlier container guidance, the dangerous part is the recommendation to use Dockerfile `ENV` for environment variables, which can cause secrets to be embedded into immutable image layers or visible in build artifacts. In a skill that explicitly discusses API keys and deployment, this becomes a practical secret-exposure risk.

Credential Access

High
Category
Privilege Escalation
Content
### Q1: 部署后记忆为空怎么办？
A: 记忆写入后有约 10 秒最终一致性延迟。等待 10 秒后用 `list_events` 重新查询。如仍为空，检查日志中是否显示 "Memory enabled"，确认部署时未使用 `--disable-memory`.
### Q2: 容器无法读取 .env 文件怎么办？
A: 容器模式下 .env 文件不会被自动读取。在 Dockerfile 中使用 `ENV` 指令设置环境变量，而非依赖 .env 文件。这是容器模式与本地开发习惯的主要差异.
### Q3: 收到 "on-demand throughput isn't supported" 错误？
A: 使用 `us.anthropic.claude-*` 推理配置文件替代按需吞吐量。这是区域和模型组合的限制，跨区域推理配置文件可自动路由到容量充足的区域.
### Q4: 代理名称无效如何修改？
Confidence
77% confidence
Finding
As with the earlier container guidance, the dangerous part is the recommendation to use Dockerfile `ENV` for environment variables, which can cause secrets to be embedded into immutable image layers or visible in build artifacts. In a skill that explicitly discusses API keys and deployment, this becomes a practical secret-exposure risk.

Static analysis

No suspicious patterns detected.