Security audit

AWS Global Search

Security checks across malware telemetry and agentic risk

Overview

This is mostly an AWS documentation helper, but its own instructions and examples expand into credentialed AWS resource-creation guidance without adequate warnings or scope controls.

Install only if you want an AWS documentation/search helper and will keep it away from direct AWS operations. Do not paste real AWS keys into prompts or generated code, and do not run the CLI/SDK snippets unless you explicitly intend to create resources, have reviewed IAM permissions, region, network exposure, and cost impact, and are using safer credential mechanisms such as AWS profiles, SSO, IAM roles, or the default credential chain.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The examples extend a read-only AWS product-information skill into operational guidance for launching EC2 instances, including CLI and SDK calls that create billable cloud resources. This is dangerous because users may reasonably trust the skill’s stated no-login/query-only scope, yet the example content encourages actions with security and cost consequences beyond that scope.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The Lambda example provides complete API/SDK/CLI instructions for creating AWS functions and includes patterns that accept direct access keys, which is materially beyond a documentation-search skill. This is dangerous because it can lead to real resource deployment, billing exposure, and poor credential practices if copied by users into production or shared environments.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Documenting how to launch EC2 instances is an unjustified expansion of capability for a product-query skill and can mislead orchestrators or users about what the skill is allowed to do. That scope drift increases the chance that a low-risk information tool is used to facilitate operational changes in cloud environments without appropriate review or consent.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest description is broadly worded enough to activate on many generic AWS-related requests, which can cause the skill to be selected outside its narrow intended scope. Over-broad routing increases the chance that unrelated or more sensitive AWS tasks are handled by a search-oriented skill, leading to misrouting, incorrect tool use, or unnecessary exposure to external content.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger condition 'mentions AWS and needs product information' is too vague and can match a wide range of conversations that only incidentally reference AWS. In practice this can cause the agent to invoke this skill for ambiguous prompts, increasing prompt-scope drift and potentially steering the model toward web retrieval when a safer or more specialized skill should handle the request.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The EC2 quick-start examples show commands and SDK calls that can create live infrastructure without any explicit warning about billing impact, security group exposure, IAM permissions, or credential safety. In the context of a product-query skill, the absence of cautions makes accidental deployment and insecure copy-paste use more likely.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The Lambda creation examples omit an explicit warning that they deploy resources and include an embedded-credentials pattern that normalizes unsafe secret handling. This is especially dangerous because users may copy the example verbatim, creating functions with privileged roles and exposing long-lived credentials in source code or logs.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.