aws-cloudformation-auto-scaling

skills-sh:giuseppe-trisciuoglio_developer-kit__aws-cloudformation-auto-scaling

View source

70/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

Score

70/100

HIGH 2

LOW 2

Findings (4)

HIGH

Code block labeled "markdown" contains executable content NLP_CODE_MISMATCH

prompt-injection L354

Code block labeled "markdown" contains executable content

AWSTemplateFormatVersion: 2010-09-09
Description: Auto Scaling with Launch Configuration

Parameters:
  InstanceType:
    Type: String
    Default: t3.micro

  AmiId:
    Type: AWS::EC2::Image::Id

  ...

FIX

Align the tool description with what the code actually does. If the description says one thing but the code does another, update the description to be accurate or fix the code.

FP?

Likely FP if the NLP analyzer misinterpreted technical jargon or the description accurately describes behavior through domain-specific terminology.

HIGH

Code block labeled "markdown" contains executable content NLP_CODE_MISMATCH

prompt-injection L421

Code block labeled "markdown" contains executable content

AWSTemplateFormatVersion: 2010-09-09
Description: Auto Scaling with Launch Template

Parameters:
  InstanceType:
    Type: String
    Default: t3.micro

  AmiId:
    Type: AWS::EC2::Image::Id

Resourc...

FIX

Align the tool description with what the code actually does. If the description says one thing but the code does another, update the description to be accurate or fix the code.

FP?

Likely FP if the NLP analyzer misinterpreted technical jargon or the description accurately describes behavior through domain-specific terminology.

LOW

Unscoped Bash tool in allowed tools INDIRECT_010

command-execution L7

Detects skills that include unscoped Bash in their allowed tools list (not Bash(cmd:*) scoped)

allowed-tools: Read, Write, Bash

FIX

Scope the Bash tool to specific commands using allowedTools patterns (e.g., Bash(git *) instead of bare Bash). Remove blanket Bash access from allowed_tools lists.

FP?

Likely FP if the Bash entry in allowed_tools is part of a constrained configuration that limits commands elsewhere (e.g., via system prompt restrictions).

LOW

System package manager install EXTDL_011

external-download L384

Detects system-level package installation via brew, apt, yum, or dnf

yum install -y h

FIX

Pin system packages to specific versions where the package manager supports it. Document the exact packages required and prefer containerized environments to avoid system-wide changes.

FP?

Likely FP if the match is standard setup documentation listing well-known system packages (e.g., apt install git curl) that are prerequisites.