aws-cdk-development
Verdict safe, but 2 findings (1 medium, 1 low), mainly unauthorized tool use, social engineering. Most recent scan 2026-02-06.
The aws-cdk-development skill is generally well-structured for AWS CDK infrastructure development with appropriate educational content and validation tooling. However, it exhibits MEDIUM severity tool exploitation risks due to overly permissive Bash command wildcards that could allow destructive operations (cdk destroy, npm malicious installs, CloudFormation stack deletion). The skill correctly uses internal reference files (references/cdk-patterns.md) which is normal and expected behavior. Minor issues include missing license/compatibility metadata (LOW severity) and potential resource exhaustion in validation scripts without timeouts (LOW severity). No data exfiltration, credential theft, prompt injection, or hardcoded secrets were detected. The skill does not make external network calls or access sensitive credential files. The validation script is purely local analysis tooling.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
AWS Cloud Development Kit (CDK) expert for building cloud infrastructure with TypeScript/Python. Use when creating CDK stacks, defining CDK constructs, implementing infrastructure as code, or when the user mentions CDK, CloudFormation, IaC, cdk synth, cdk deploy, or wants to define AWS infrastructure programmatically. Covers CDK app structure, construct patterns, stack composition, and deployment workflows.
- Package
- 3 files, 27 KB
- SKILL.md
- 1216 words, 12+ sections
- Code
- Shell (1)
- Allowed tools
mcp__cdk__*mcp__aws-mcp__*mcp__awsdocs__*Bash(cdk *)Bash(npm *)Bash(npx *)Bash(aws cloudformation *)Bash(aws sts get-caller-identity)
SKILL.md covers: AWS CDK Development · AWS Documentation Requirement · Before Answering AWS Questions · Integrated MCP Servers · AWS CDK MCP Server · When to Use This Skill · Core CDK Principles · Resource Naming · Lambda Function Development · Pre-Deployment Validation · Workflow Guidelines · Development Workflow
Findings
MEDIUM Overly Permissive Tool Access - Unrestricted Bash Commands Unauthorized Tool Usellm
The skill declares allowed-tools with wildcard patterns that grant excessive permissions. Specifically, 'Bash(cdk *)' allows execution of ANY cdk command, 'Bash(npm *)' allows ANY npm command, 'Bash(npx *)' allows ANY npx command, and 'Bash(aws cloudformation *)' allows ANY CloudFormation command. This creates tool exploitation risks where malicious or unintended commands could be executed under the guise of legitimate CDK operations. For example, 'npm install' could install malicious packages, 'cdk destroy' could delete infrastructure, or 'aws cloudformation delete-stack' could remove critical resources.
SKILL.md
allowed-tools: mcp__cdk__*, mcp__aws-mcp__*, mcp__awsdocs__*, Bash(cdk *), Bash(npm *), Bash(npx *), Bash(aws cloudformation *), Bash(aws sts get-caller-identity)LOW Missing License and Compatibility Metadata Social Engineeringllm
The skill manifest does not specify 'license' or 'compatibility' fields. While this is not a direct security threat, it represents incomplete metadata that could mislead users about usage rights and supported environments. Users cannot determine if the skill is safe to use in their legal/compliance context or whether it will work in their specific Claude environment (Claude.ai, Claude Code, API).
SKILL.md
license: Not specified, compatibility: Not specifiedWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 10 KB |
references/cdk-patterns.md | doc | 9.6 KB |
scripts/validate-stack.sh | script | 7.0 KB |
External hosts referenced
github.com marketplace.visualstudio.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
PROJECT_ROOT VALIDATION_PASSED
Package contents recorded 2026-10-22 at commit e48bf4c63b6a. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/zxkane/aws-skills
- Raw scan result: plugins-aws-cdk-skills-aws-cdk-development-scan.json
- Badge for your README:
- Request a re-scan