ClawHub
Back to skill

Security audit

Aws Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This AWS operations skill is broadly purpose-aligned, but it recommends high-impact cloud changes with insufficient safeguards and relies on missing or unpinned installation materials.

Review this skill carefully before installing. Use it only with a deliberately scoped AWS profile or role, prefer dry-run or plan output before applying changes, avoid --auto-approve, do not run the agent as administrator, and do not install missing or unpinned dependency files unless you can verify their source and contents.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:145
Finding

Unpinned and Unverifiable Python Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 145 and 218-219
Vulnerability Type: Supply-chain risk through unpinned dependencies
Risk Level: Medium

Vulnerable Snippets

bash
pip install -r requirements_pro.txt
markdown
| boto3 | Python library | Required | `pip install boto3` |
| awscli | CLI tool | Required | `pip install awscli` |

The project contains only SKILL.md. The referenced requirements_pro.txt is not present in the audited artifact, so its package names, versions, sources, and integrity constraints cannot be reviewed.

Technical Analysis

The installation instructions do not pin reviewed dependency versions or require cryptographic hashes. Running pip install boto3 or pip install awscli resolves whatever versions the configured Python package index currently serves. The missing requirements file also creates an unverifiable external dependency on content that is not part of the reviewed package.

This does not demonstrate that boto3 or awscli is malicious. The risk arises because dependency resolution and the absent manifest are not constrained by the audited artifact. A compromised package index, poisoned mirror, modified requirements file, or future compromised release could cause package installation code to execute locally.

Attack Path

  1. A user follows the dependency-installation instructions.
  2. The user obtains the missing requirements file from an unreviewed source or resolves unpinned packages through the configured package index.
  3. An attacker controls or compromises a referenced package, package release, requirements file, or package mirror.
  4. pip downloads and installs the attacker-controlled distribution.
  5. Installation-time or subsequently imported package code executes with the privileges of the user running pip.

Impact Assessment

Successful exploitation could execute arbitrary code with the installing user's pri ...[truncated 451 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include requirements_pro.txt in the reviewed project.
  2. Pin every direct and transitive dependency to a reviewed version.
  3. Record cryptographic hashes and install with pip install --require-hashes -r requirements_pro.txt.
  4. Use a controlled package index or approved internal mirror rather than unconstrained package resolution.
  5. Generate and retain a lock file and software bill of materials.
  6. Scan dependencies for known vulnerabilities before release and during maintenance.
  7. Install dependencies in an isolated virtual environment as a non-administrative user.
  8. Document verified package sources and an update-review procedure.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:378
Finding

Blanket Recommendation to Run with Administrator Privileges

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 378 and 406
Vulnerability Type: Unnecessary privilege elevation
Risk Level: Medium

Vulnerable Snippet

The following is a faithful English rendering of the duplicated troubleshooting entry:

markdown
| Insufficient permissions | Current user lacks read/write permission | Check file permissions; run as administrator |

Technical Analysis

The troubleshooting guidance recommends running as an administrator whenever a read/write permission failure occurs. It does not identify a narrowly scoped operation that legitimately requires administrative access, distinguish file ownership problems from system-level access requirements, or instruct users to elevate only a specific trusted command.

Permission failures should ordinarily be addressed by correcting ownership, selecting a user-writable location, or granting the minimum required access. Elevating the entire agent, dependency installer, or future script unnecessarily expands the privilege boundary and increases the consequences of dependency compromise or unsafe commands.

Attack Path

  1. A command described by the skill encounters or intentionally triggers a file-permission error.
  2. The user follows the troubleshooting guidance and reruns the agent or command with administrator privileges.
  3. A compromised dependency, untrusted requirements file, unsafe future script, or manipulated command executes in the elevated context.
  4. The code gains access beyond the original user's legitimate task requirements.
  5. It can modify protected files or perform other administrator-level operations allowed by the operating system.

Impact Assessment

Exploitation could provide administrator-level execution on the local machine, permitting access to protected files, system-wide configuration changes, installation of software, or modification of other users' resources.

The audited artifact contain ...[truncated 275 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the blanket instruction to run as an administrator.
  2. Direct users to inspect file ownership and permissions before considering elevation.
  3. Store generated files in explicitly documented user-writable directories.
  4. Specify the exact resources and minimum permissions required by each operation.
  5. If elevation is unavoidable, elevate only a specific, reviewed command rather than the entire agent or shell.
  6. Require confirmation before any privileged operation and display the exact command and affected resources.
  7. Keep package installation and AWS automation in isolated, non-administrative environments.
  8. Add safeguards that refuse unnecessary root or administrator execution.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill’s activation/usage description is very broad and ambiguous, covering security detection, compliance auditing, vulnerability scanning, encryption protection, enterprise operations, and general AWS management without clear boundaries or authorization checks. In an agent setting with exec/write capabilities, vague triggers can cause the skill to activate in contexts the user did not explicitly intend, increasing the chance of overbroad cloud actions or sensitive-environment interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description states '支持中文交互' and the skill branding and content are presented as Chinese-first, but there is no indication that users may opt into another language. This can violate language or locale policy when a skill effectively forces a specific language without explicit user choice or documented regional justification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

This finding is a duplicate instance of the same risky behavior: the explicit '--auto-approve' flag bypasses human review for infrastructure changes. Because the skill advertises enterprise-scale AWS management and multi-region automation, the context makes this more dangerous than a local-only script: it can rapidly enact high-impact cloud changes with financial, availability, and security consequences.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
# 部署基础设施
python3 （请参考skill目录中的脚本文件） apply \
  --config ./terraform/ \
  --auto-approve
# ...
# 输出：
# VPC: 10.0.0.0/16 (2区域)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

This finding is a duplicate instance of the same risky behavior: the explicit '--auto-approve' flag bypasses human review for infrastructure changes. Because the skill advertises enterprise-scale AWS management and multi-region automation, the context makes this more dangerous than a local-only script: it can rapidly enact high-impact cloud changes with financial, availability, and security consequences.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
# 部署基础设施
python3 （请参考skill目录中的脚本文件） apply \
  --config ./terraform/ \
  --auto-approve
# ...
# 输出：
# VPC: 10.0.0.0/16 (2区域)

Static analysis

No suspicious patterns detected.