Aws Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

The skill is an AWS administration helper, but it asks for broad agent and cloud authority while giving vague activation scope and weak safeguards around destructive AWS actions.

Review this skill before installing. Use only with least-privileged, non-root AWS credentials, avoid default production profiles, require explicit confirmation for stop/delete/IAM changes, and install dependencies in an isolated environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:135

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 135
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

bash

pip install boto3

Technical Analysis

The installation command does not pin boto3 to a reviewed version, verify package hashes, or use an integrity-locked dependency manifest. Consequently, dependency resolution can produce different package and transitive-dependency versions over time.

If the configured package index, a resolved dependency, or a future release is compromised, installation may invoke attacker-controlled build components. Malicious dependency code may also execute when the package is subsequently imported. The risk is heightened because this Skill expects AWS credentials to be configured on the same host.

Attack Path

1. An attacker compromises a dependency release, its distribution channel, or the package-index configuration used by the environment.
2. A user follows the Skill instructions and runs pip install boto3.
3. Pip resolves the unpinned package and its transitive dependencies from the configured index.
4. Attacker-controlled code executes during package building or when the installed dependency is imported by an AWS-management program.
5. The code accesses resources available to the local process, potentially including AWS credentials and authenticated AWS APIs.

Impact Assessment

Exploitation could provide code execution with the privileges of the user running pip or the dependent program. The accessible scope may include local files, environment variables, AWS configuration files, and AWS resources authorized by the configured credentials. Actual cloud impact is bounded by the associated IAM permissions.

No evidence establishes that the named package is currently malicious; this finding concerns the absence of reproducible dependency and integrity controls.

Remediation

View remediation

Remediation Suggestions

1. Pin all direct and transitive dependencies to reviewed versions in a lock file.
2. Record and enforce cryptographic hashes using a command such as python -m pip install --require-hashes -r requirements.txt.
3. Generate dependency locks through a controlled review process and update them only after security testing.
4. Install packages inside an isolated virtual environment using a trusted, explicitly configured package index.
5. Run dependency vulnerability and provenance checks in CI before publishing the Skill.
6. Use temporary, least-privileged AWS credentials so a compromised dependency cannot access unrelated cloud resources.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description uses very broad activation cues like 'code generation', 'programming assistance', 'debugging', and 'deployment', which overlap with many ordinary developer requests unrelated to AWS. In an agent ecosystem, this can cause the skill to be invoked outside its intended scope, increasing the chance of unnecessary credential use or unexpected infrastructure actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises destructive operations such as stopping and deleting cloud resources without a prominent warning, confirmation requirement, or discussion of cost and service-impact risks near the operation descriptions. In the context of AWS administration, accidental execution can disrupt running systems, destroy data-bearing resources, or incur financial and operational damage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The coverage keyword list includes vague and generic trigger terms such as 'Use', 'when', '需要代码生成', and other broad fragments that do not meaningfully constrain invocation. This expands matching surface area and can cause accidental routing of unrelated requests into a skill that has read/write/exec capability and can perform cloud-affecting operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.