T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.py:14- Finding
Bearer Token Exfiltration Through Unvalidated AWS Region
- Content
View full analysis
- Remediation
View remediation
Security audit
Nova Canvas
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real AWS Bedrock image generator, but its credential handling has a concrete token-leak risk and its documentation encourages unsafe secret use.
Review before installing. Prefer AWS profiles, SSO, IAM roles, or environment-based credentials managed outside command transcripts. Avoid passing AWS secrets or bearer tokens on the command line, and do not let untrusted text control --region. The skill should validate regions or use an AWS SDK endpoint resolver before it is used with bearer tokens.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate.py:116- Finding
Sensitive AWS Credentials Accepted and Documented as Command-Line Arguments
- Content
View full analysis
/cmdl ...[truncated 2584 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)
Tainted flow: 'req' from os.environ.get (line 25, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = urllib.request.Request(url, data=body.encode(), headers=headers, method="POST") try: with urllib.request.urlopen(req, timeout=120) as resp: return json.loads(resp.read()) except urllib.error.HTTPError as e: err_body = e.read().decode() if e.fp else ""
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md |--------|------------| | **Bearer token** | `AWS_BEARER_TOKEN_BEDROCK` env var or `--bearer-token` | | **Environment variables** | Set `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` | | **Credentials file** | Configure `~/.aws/credentials` | | **Named profile** | `--profile my-profile` or `AWS_PROFILE` env var | | **Direct keys** | `--access-key AKIA... --secret-key ...` | | **Temporary credentials** | Add `--session-token` with direct keys |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python |--------|------------| | **Bearer token** | `AWS_BEARER_TOKEN_BEDROCK` env var or `--bearer-token` | | **Environment variables** | Set `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` | | **Credentials file** | Configure `~/.aws/credentials` | | **Named profile** | `--profile my-profile` or `AWS_PROFILE` env var | | **Direct keys** | `--access-key AKIA... --secret-key ...` | | **Temporary credentials** | Add `--session-token` with direct keys |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python |--------|------------| | **Bearer token** | `AWS_BEARER_TOKEN_BEDROCK` env var or `--bearer-token` | | **Environment variables** | Set `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` | | **Credentials file** | Configure `~/.aws/credentials` | | **Named profile** | `--profile my-profile` or `AWS_PROFILE` env var | | **Direct keys** | `--access-key AKIA... --secret-key ...` | | **Temporary credentials** | Add `--session-token` with direct keys |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python |--------|------------| | **Bearer token** | `AWS_BEARER_TOKEN_BEDROCK` env var or `--bearer-token` | | **Environment variables** | Set `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` | | **Credentials file** | Configure `~/.aws/credentials` | | **Named profile** | `--profile my-profile` or `AWS_PROFILE` env var | | **Direct keys** | `--access-key AKIA... --secret-key ...` | | **Temporary credentials** | Add `--session-token` with direct keys |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill describes capabilities that rely on environment access and outbound network access to AWS Bedrock, but it does not declare an explicit tool scope or allowed-tools boundary. That omission increases the chance of over-broad execution context, accidental access to local secrets, or use of network-enabled tooling beyond what is necessary for image generation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad and common, so the skill may activate for generic image-related requests even when the user did not intend to use AWS-backed generation. Unintended activation can expose prompts to external services, incur cloud costs, and cause the agent to use credentials or network actions in situations where a simpler or safer response was expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation normalizes passing direct AWS credentials on the command line and via multiple exposed channels without warning about secret-handling risks. Command-line secrets may be leaked through shell history, process listings, logs, screenshots, or copied transcripts, making credential compromise more likely in normal use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file directs users to 'Craft a detailed English prompt' and repeats that 'Detailed English prompts yield best results'. This is a language preference presented as workflow guidance without offering the user a language choice or framing English as optional, which can violate language/locale policy expectations.
- Content
Static analysis
No suspicious patterns detected.