Scanned skills

aws/agent-toolkit-for-aws aws-marketplace-metering

Checked the catalogued skill at aws-marketplace-metering.

SkillTrust corpus scan 7 November 2026 v0.13.0 via skillsh Verify on GitHub
D AI-triaged 5
D Security

D; retained sample includes a high finding · SD-022 · what this rule accepts as a false positive →

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

B Transparency

B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →

5 findings
securityhigh SD-022
SKILL.md
securitymedium SD-008
assets/template-events.yaml
transparencymedium SD-007
assets/template-main.yaml
permission_hygienehigh SD-003
references/deployment-steps.md
securityhigh SD-007
scripts/query_metering.py
9 suppressed by AI triage
permission_hygienehigh SD-003 benign_example
references/deployment-steps.md

No path traversal evidence in the context; the line contains only empty content.

securitymedium SD-008 benign_example
references/iam-credentials.md

The string is an AWS ARN, not Base64-encoded data, so it is not obfuscation.

securityhigh SD-007 benign_example
scripts/deploy.sh

The string is a static documentation URL, not an outbound network call

securityhigh SD-007 benign_example
scripts/deploy.sh

It is a static error message with a URL, not a network request

securityhigh SD-007 benign_example
scripts/deploy.sh

The URL is only referenced in an error message, not executed

securitymedium SD-008 benign_example
scripts/deploy.sh

The matched string is an AWS ARN, not a base64 encoded payload

securityhigh SD-007 benign_example
scripts/query_metering.py

URL reference appears only in a documentation string, not an actual outbound network call.

securitymedium SD-008 benign_example
scripts/register.py

Standard decoding of base64‑encoded request bodies in an AWS Lambda handler, not indicative of malicious obfuscation.

securityhigh SD-007 benign_example
scripts/subscription.py

The line contains only a documentation URL in a comment, not an actual network call.