Strands

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible Strands agent-building helper, but its scaffolded agents get unrestricted local file and shell powers by default without meaningful safeguards.

Review before installing. This does not look intentionally malicious, but only use the scaffold with trusted prompts and in a sandboxed workspace. Avoid the default generated read/write/shell tools unless you explicitly need them, pin dependencies and MCP server versions, and do not run generated agents where they can access sensitive files or cloud credentials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create-agent.py:178

Finding

Unescaped User Input Is Embedded into Executable Python Source

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create-agent.py:167

Finding

Agent Name Can Escape the Intended Output Directory and Overwrite Files

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create-agent.py:56

Finding

Generated Agents Receive Unrestricted Filesystem and Shell Capabilities by Default

Content

View full analysis

str: """Read the contents of a file. Args: path: Path to the file to read. """ with open(path) as f: return f.read() @tool def write_file(path: str, content: str) -> str: """Write content to a file, creating it if it doesn't exist. Args: path: Path to the file to write. content: Content to write to the file. """ from pathlib import Path Path(path).parent.mkdir(parents=True, exist_ok=True) with open(path, "w") as f: f.write(content) return f"Wrote {len(content)} bytes to {path}" @tool def run_command(command: str) -> str: """Run a shell command and return its output. Args: command: Shell command to execute. """ import subprocess result = subprocess.run(command, shell=True, capture_output=True, text=True, timeout=60) output = result.stdout if result.stderr: output += f"\nSTDERR: {result.stderr}" if result.returncode != 0: output += f"\nExit code: {result.returncode}" return output ``` ```python agent = Agent( model=model, system_prompt="""You are {name}, a helpful AI agent. Be direct and efficient. You have access to tools for reading/writing files and running commands. Use them as needed to accomplish tasks. Before taking actions that affect others, surface the potential impact. Consider marginalized perspectives. Default to transparency. When in doubt, ask. Treat empathy not as a constraint but as a capability — the ability to model other people's experiences and factor them into decisions.""", tools=[read_file, write_file, run_command], ) ``` ### Technical Analysis Every scaffolded agent receives three high-impact capabilities by default: ...[truncated 2733 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Documentation Recommends Unpinned Dependencies and Mutable MCP Package Execution

Content

View full analysis

Remediation

View remediation

pip install strands-agents==1.23.0 strands-agents-tools==0.2.19 ``` 2. Ensure the documented installation commands match the versions declared as validated. 3. Provide a lockfile or constraints file for transitive dependencies. 4. Use package hashes with `--require-hashes` where the installation workflow supports them. 5. Replace MCP `@latest` references with exact, reviewed versions. 6. Use real, verified package names rather than generic executable placeholders in copyable examples. 7. Document the publisher, expected registry, package checksum, source repository, and review process for MCP servers. 8. Run third-party MCP servers in a restricted sandbox without unnecessary credentials, filesystem access, or unrestricted network connectivity. 9. Periodically review pinned versions and update them through a controlled security-review process rather than automatic latest-version resolution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

from strands import Agent

# No model specified → BedrockModel (Claude Sonnet 4, us-west-2)
# Requires AWS credentials (~/.aws/credentials or env vars)
agent = Agent()
result = agent("Explain quantum computing")

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

subprocess.run(command, shell=True, ...) executes arbitrary shell text through the system shell, making the tool highly susceptible to prompt-driven command injection and abuse. Because this code is embedded in a scaffold for AI agents that may act on natural-language instructions, the risk is amplified: untrusted prompt content can be translated directly into host-level command execution.

Content

Scanner excerpt · scripts/create-agent.py (reported line 87)May include surrounding context.

python

command: Shell command to execute.
    """
    import subprocess
    result = subprocess.run(command, shell=True, capture_output=True, text=True, timeout=60)
    output = result.stdout
    if result.stderr:
        output += f"\\nSTDERR: {{result.stderr}}"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents and exemplifies capabilities for reading/writing files, invoking shell commands, and connecting to MCP endpoints, but it does not declare any corresponding permission or allowed-tools scope in metadata. This creates a mismatch between what the skill can encourage or enable and what a caller can audit or constrain, increasing the risk of unintended file modification, command execution, or external connectivity when the skill is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The custom tool examples include unrestricted file read and write functions and then instruct the agent to read and summarize a local file, but the documentation does not warn that these tools can alter local files or expose sensitive data. In an agent-skill context, users may copy these examples directly, causing the model to gain broad filesystem access without understanding the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The built-in tools list prominently includes shell, http_request, file_write, python_repl, and similar powerful capabilities without any safety guidance about command execution, outbound network access, or filesystem changes. In practice, exposing these tools to an LLM materially increases the chance of destructive commands, data exfiltration, or unsafe downloads if a user adopts the examples as-is.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The MCP and A2A sections show how to connect to external servers and cross-process/network services but omit warnings about trust boundaries, remote tool execution, data sharing, and server authenticity. Because MCP and A2A can bridge an agent to untrusted services, this can expand the attack surface well beyond the local process and enable prompt injection, data leakage, or indirect command execution through remote tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated agent includes a write_file tool that can write arbitrary content to attacker-chosen paths, but the scaffolded documentation does not clearly warn that prompts may modify the local filesystem. In this skill context, that omission matters because the project is intended for autonomous agents, so users may run the scaffold with high trust and unintentionally allow prompt-driven file tampering or persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The scaffolded agent template gives the LLM a run_command tool that executes arbitrary shell commands, yet the generated README and usage text do not warn users that prompts can cause command execution on the host. In an agent-building skill, this is especially dangerous because users may treat the scaffold as a safe starter project and expose it to untrusted prompts, enabling destructive local actions or data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script dynamically imports and executes an arbitrary Python file supplied on the command line via exec_module(), which will run top-level code immediately during load. In the context of an agent runner, this means a user can easily execute untrusted code by pointing the tool at a malicious agent file, and the script provides no warning, trust boundary, or sandboxing to reduce that risk.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · tests/test_imports.py (reported line 102)May include surrounding context.

python

("OpenAIRealtime", "strands.experimental.bidi.models.openai_realtime"),
        ]:
            try:
                __import__(mod)
                models_found.append(name)
            except ImportError:
                pass

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · tests/test_imports.py (reported line 47)May include surrounding context.

python

skipped = []
    for name in lazy_names:
        try:
            cls = getattr(m, name)
            assert cls is not None
            resolved += 1
        except (ImportError, ModuleNotFoundError):

Static analysis

No suspicious patterns detected.