ClawHub
Back to skill

Security audit

AWS Health

Security checks for vulnerabilities and agentic risk

Overview

This AWS health skill has a plausible purpose, but it asks for cloud credentials while relying on an unpinned runtime package and a missing script that cannot be reviewed.

Review before installing. Use only short-lived, least-privilege read-only AWS credentials, avoid exposing those credentials in chat or logs, and do not run this skill until the missing health-check script is packaged and the tsx dependency is pinned or lockfile-controlled.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Package Executed with Access to AWS Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17 and 42–57
Vulnerability Type: Unpinned dependency and unsafe runtime package resolution
Risk Level: Medium

The Skill declares tsx as a dependency without an exact version, integrity hash, lockfile, or trusted registry configuration:

yaml
install:
  - kind: node
    package: tsx
    bins: [tsx]

It subsequently instructs the Agent to execute the dependency through npx:

bash
cd {baseDir} && npx tsx scripts/aws-health.ts

The same execution pattern is used for the optional arguments:

bash
cd {baseDir} && npx tsx scripts/aws-health.ts --only ec2
cd {baseDir} && npx tsx scripts/aws-health.ts --only ecs
cd {baseDir} && npx tsx scripts/aws-health.ts --only ecs --cluster my-cluster-name

Technical Analysis

The dependency declaration does not constrain tsx to a reviewed release. No package manifest, lockfile, package integrity value, or registry restriction is present in the supplied project. Consequently, the package version selected during installation may change after the Skill has been audited.

Use of npx adds runtime resolution risk. If an appropriate local executable is unavailable, depending on the environment and npm configuration, npx can retrieve and execute a package from the configured package registry. This creates a supply-chain trust boundary in the Skill's execution path.

The Skill requires the process environment to contain AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, and optionally AWS_SESSION_TOKEN. Third-party package code executed in that process can read inherited environment variables. A compromised package release, registry, or dependency resolution path could therefore expose AWS credentials or perform AWS operations under the credentials' permissions.

The referenced scripts/aws-health.ts implementation is absent from the supplied ...[truncated 1869 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin tsx to an exact, reviewed version rather than using an unconstrained package name.
  2. Add a package manifest and committed lockfile containing integrity metadata. Install dependencies using a reproducible command such as npm ci.
  3. Preinstall dependencies during a controlled build or installation stage. Do not permit invocation-time downloads.
  4. Invoke the locked local executable directly, such as ./node_modules/.bin/tsx, or use an npm script backed by the lockfile instead of runtime npx resolution.
  5. Configure an approved registry explicitly and enforce package integrity or provenance verification where supported.
  6. Add the missing scripts/aws-health.ts source to the package so its behavior can be reviewed and verified before execution.
  7. Run the Skill in a restricted environment with minimal filesystem and network access.
  8. Use short-lived AWS credentials, preferably through an IAM role or workload identity, and enforce a dedicated least-privilege policy limited to the required read-only EC2, ECS, and CloudWatch actions.
  9. Prevent inherited AWS credentials from being available to package installation lifecycle scripts. Install dependencies before injecting runtime credentials, and disable unnecessary npm lifecycle scripts where practical.
  10. Monitor CloudTrail for unexpected activity and rotate or revoke credentials immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill requests AWS credentials and region configuration but does not warn about the sensitivity of those secrets or that infrastructure metadata will be transmitted to AWS APIs. This omission can lead users to provide long-lived credentials casually, misunderstand the privacy impact, or run the skill in contexts where exposure and logging risks are not understood.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are broad enough to activate the skill for vague requests like 'Check my infra,' which can cause the agent to access AWS using stored credentials even when the user's intent is ambiguous. In a credentialed cloud context, overbroad invocation increases the chance of unnecessary sensitive API calls and unintended disclosure of infrastructure status.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx tsx without pinning an exact version allows the runtime to resolve whatever package version is available at execution time. In a skill that runs with AWS credentials in environment variables, a compromised or unexpected package version could execute attacker-controlled code and exfiltrate credentials or manipulate results.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This invocation again relies on unpinned npx tsx, which makes the executed code dependent on external package resolution rather than a fixed, reviewed version. Because the command runs in an environment containing AWS access keys, any supply-chain compromise could lead to credential theft or unauthorized AWS API use.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

An unpinned npx tsx command introduces supply-chain risk by allowing a non-deterministic package version to run at execution time. In the context of AWS health checks, that risk is amplified because the process has access to sensitive cloud credentials and account metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This fourth unpinned runtime invocation repeats the same supply-chain exposure: the package executed by npx may not be the version originally reviewed by the skill author. If abused, it could run arbitrary code with access to AWS credentials, region settings, and queried infrastructure metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.