aws-agentic-ai
Verdict safe, but 2 findings (1 medium, 1 low), mainly data exfiltration, resource abuse. Most recent scan 2026-02-06.
The aws-agentic-ai skill is a comprehensive AWS Bedrock AgentCore management tool with SAFE overall security posture. The skill provides legitimate AWS infrastructure management capabilities through AWS CLI commands and MCP tools. All referenced documentation files are internal to the skill package (normal behavior). The bash scripts follow standard DevOps patterns for AWS deployment automation. The primary concerns are minor: potential account ID exposure in logs (MEDIUM), missing error handling that could cause availability issues (LOW), and missing optional metadata (LOW). No critical threats such as data exfiltration, prompt injection, or malicious code execution were detected. The skill correctly requires AWS MCP tools and includes proper dependency management (aws-mcp-setup). The allowed-tools configuration appropriately restricts operations to AWS CLI commands and MCP tools.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
AWS Bedrock AgentCore comprehensive expert for deploying and managing all AgentCore services. Use when working with Gateway, Runtime, Memory, Identity, or any AgentCore component. Covers MCP target deployment, credential management, schema optimization, runtime configuration, memory management, and identity services.
- Package
- 13 files, 106 KB
- SKILL.md
- 587 words, 12+ sections
- Code
- Shell (2)
- Allowed tools
mcp__aws-mcp__*mcp__awsdocs__*Bash(aws bedrock-agentcore-control *)Bash(aws bedrock-agentcore-runtime *)Bash(aws bedrock *)Bash(aws s3 cp *)Bash(aws s3 ls *)Bash(aws secretsmanager *)Bash(aws sts get-caller-identity)
SKILL.md covers: AWS Bedrock AgentCore · AWS Documentation Requirement · Before Answering AWS Questions · When to Use This Skill · Available Services · Common Workflows · Deploying a Gateway Target · Managing Credentials · Monitoring Agents · Service-Specific Documentation · Gateway Service · Runtime, Memory, Identity, Code Interpreter, Browser, Observability
Findings
MEDIUM Hardcoded AWS Account ID Exposure in Deployment Script Data Exfiltrationllm
The deploy-template.sh script retrieves and exports the AWS account ID (CDK_DEFAULT_ACCOUNT) which could be logged or exposed in error messages. While not a direct credential leak, account IDs are sensitive metadata that can aid attackers in reconnaissance and targeted attacks.
services/gateway/deploy-template.sh
export CDK_DEFAULT_ACCOUNT=$(aws sts get-caller-identity --query Account --output text --profile ${AWS_PROFILE:-default})LOW Missing Error Handling for AWS CLI Commands Resource Abusellm
Multiple bash scripts execute AWS CLI commands without comprehensive error handling beyond 'set -e'. If AWS CLI commands fail silently or return unexpected output, the scripts may continue execution in an inconsistent state, potentially causing resource exhaustion or deployment failures.
services/gateway/deploy-template.sh
set -e is used but individual command failures may not be caught properly, especially in pipelines or subshellsWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 6.5 KB |
cross-service/credential-management.md | doc | 14 KB |
services/browser/README.md | doc | 10 KB |
services/code-interpreter/README.md | doc | 7.6 KB |
services/gateway/README.md | doc | 3.3 KB |
services/gateway/deploy-template.sh | script | 2.8 KB |
services/gateway/deployment-strategies.md | doc | 11 KB |
services/gateway/troubleshooting-guide.md | doc | 10 KB |
services/gateway/validate-deployment.sh | script | 5.6 KB |
services/identity/README.md | doc | 6.7 KB |
services/memory/README.md | doc | 8.1 KB |
services/observability/README.md | doc | 14 KB |
services/runtime/README.md | doc | 6.7 KB |
External hosts referenced
docs.aws.amazon.com aws.amazon.com awscli.amazonaws.com provider.com developer.mozilla.org opentelemetry.io
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
AWS_PROFILE AWS_REGION GATEWAY_ID TARGET_ID CDK_DEFAULT_ACCOUNT CREDENTIAL_PROVIDER_NAME CREDENTIAL_PROVIDER_NOT_FOUND NEW_KEY SECRET
Package contents recorded 2026-10-22 at commit e48bf4c63b6a. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/zxkane/aws-skills
- Raw scan result: plugins-aws-agentic-ai-skills-aws-agentic-ai-scan.json
- Badge for your README:
- Request a re-scan