Why this verdict
- suspicious: finding skill:skills/performing-aws-account-enumeration-with-scout-suite:skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md:248:RECON
- suspicious: finding skill:skills/performing-aws-account-enumeration-with-scout-suite:skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md:61:SUPPLY
Security findings 2
Supply chain
mediumContextual risklow confidenceThe skill's installation documentation instructs an unpinned pip install of scoutsuite/boto3 and a git clone of the ScoutSuite GitHub repository with pip install -r requirements.txt, pulling mutable latest-version remote code at setup time, which exposes the host to upstream compromise or version drift.
pip install scoutsuite
vector:instruction
Counter-argument considered
The install instructions are unpinned (`pip install scoutsuite`, `pip install scoutsuite boto3`) and add an undeclared from-source git-clone route with `pip install -r requirements.txt`, pulling mutable latest code; the pinned official-registry carve-out does not apply and the declared description only declares the pip-install delivery mechanism. Disclosure of the pip path does not cover the unpinned/source routes, so the finding stands at its stated low, contextual severity.
Reconnaissance
lowContextual risklow confidenceThe skill, declared for assessing AWS accounts with read-only IAM credentials, additionally instructs ScoutSuite scan commands against Azure and GCP accounts, an undeclared enumeration capability beyond its stated AWS-only purpose; it is openly shown rather than hidden, so it is unexplained residue.
ScoutSuite supports multiple cloud providers using the same framework:
vector:instruction
Counter-argument considered
The agent-read skill body does contain a Multi-Cloud section instructing Azure and GCP scout scan commands, and neither the AWS-only declared description nor any listed declared claim (D3, D9, D17, D19-D22) covers multi-cloud enumeration, so no carve-out or mitigation neutralizes it. The claim accurately describes open, undeclared scope residue.
Open questions 1
What the analysis could not settle from the code alone.
Detector leads (DET:243a04120927affb, DET:8ec29689f2e6e8c2, DET:c69eb68bb2080b35) cite file writes in scripts/process.py and scripts/agent.py at lines outside the shown spans; the excerpts show writes to the declared report output (args.output / output_file), and report generation is declared in the skill description, so no contradiction with the read-only IAM-credentials claim was confirmable from shown text. Full script bodies belong to a behavior pass.
