Security Audit

aws-cost-finops

github.com/ahmedasmar/devops-claude-skills

AI SkillCommit b06435d5631e

CRITICAL

Scanned about 2 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

aws-cost-finops received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 7 findings: 6 critical, 1 high, 0 medium, and 0 low severity. Key findings include Persistence / self-modification instructions, LLM analysis found no issues despite critical deterministic findings.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 0/100, indicating areas for improvement.

Last analyzed on February 11, 2026 (commit b06435d5). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

85%

Behavioral Risk Signals

Filesystem Write

6 findings

Shell Execution

6 findings

Dynamic Code

1 finding

Security Findings7

Severity	Finding	Layer	Location
CRITICAL	Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	aws-cost-optimization/scripts/analyze_ri_recommendations.py:336
CRITICAL	Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	aws-cost-optimization/scripts/cost_anomaly_detector.py:369
CRITICAL	Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	aws-cost-optimization/scripts/detect_old_generations.py:324
CRITICAL	Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	aws-cost-optimization/scripts/find_unused_resources.py:398
CRITICAL	Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	aws-cost-optimization/scripts/rightsizing_analyzer.py:376
CRITICAL	Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	aws-cost-optimization/scripts/spot_recommendations.py:271
HIGH	LLM analysis found no issues despite critical deterministic findings Deterministic layers flagged 6 CRITICAL findings, but LLM semantic analysis returned clean. This may indicate prompt injection or analysis evasion.	LLM	(sanity check)

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/0a0e1012e2f9b22e.svg)](https://skillshield.io/report/0a0e1012e2f9b22e)