ClawHub
Back to skill

Security audit

aws-infra-free

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a read-only AWS inventory helper, but it exposes AWS CLI execution and optional external callbacks without enough scoping or disclosure.

Review before installing. Use it only with least-privilege AWS read-only credentials, avoid supplying callback_url unless it is a trusted HTTPS endpoint, and prefer per-command --region over changing your global AWS CLI region. Do not let the agent run AWS commands outside the documented inventory and health-check queries.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The skill is marketed as read-only, but it instructs users to run 'aws configure set region', which mutates persistent local AWS CLI configuration. This can change later command behavior outside the skill session, potentially causing operators or downstream automation to query or act in the wrong region and increasing the risk of accidental impact or mis-scoped operations.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill accepts broad free-form input such as 'input ... data or instructions' while exposing exec capability, without clearly constraining which AWS CLI commands may be constructed or executed. In an agent setting, vague invocation boundaries can enable prompt-driven command expansion beyond the intended read-only scope, especially if user input is transformed into shell commands.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documented callback_url parameter introduces an external data egress path but does not warn that AWS inventory, alarm, or health data may be transmitted to a third-party endpoint. In a cloud operations context, even read-only results can contain sensitive infrastructure metadata, so silent or poorly understood callbacks materially raise data leakage risk.

Static analysis

No suspicious patterns detected.