Skills/PyPI/awslabs.aws-serverless-mcp-server

awslabs.aws-serverless-mcp-server@0.2.0

CAUTION

Publisher claims: "An AWS Labs Model Context Protocol (MCP) server for AWS Serverless" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher awslabs · joined 9 days agoInstalls 24,022Last detonated 7d ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File permission modification commandawslabs/aws_serverless_mcp_server/tools/esm/esm_recommend.py:935 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
AWS access key pattern detectedtests/test_data_scrubber.py:215 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
URL with embedded credentialstests/test_data_scrubber.py:75 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
AWS access key pattern detectedtests/test_data_scrubber.py:34 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
AWS access key pattern detectedtests/test_data_scrubber.py:281 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
AWS access key pattern detectedtests/test_data_scrubber.py:32 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
AWS access key pattern detectedtests/test_data_scrubber.py:266 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
URL with embedded credentialstests/test_data_scrubber.py:272 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File permission modification commandtests/test_deploy_service.py:250 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_deploy_service.py:177 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_deploy_service.py:705 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Pipe-to-shell patterntests/test_startup_script_generator.py:418 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandtests/test_startup_script_generator.py:394 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shelltests/test_startup_script_generator.py:418 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandtests/test_startup_script_generator.py:347 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim awslabs: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  3. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  4. AWS access key pattern detected≈ +2 on the totalNever read or enumerate credential locations; accept a documented environment variable instead.
  5. URL with embedded credentials≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim awslabs