{"data":{"skill":{"slug":"sickn33-aws-iam-best-practices","name":"aws-iam-best-practices","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security/aws-iam-best-practices","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"4b776259-1208-4bd9-af00-dec01a54bb7c","skill_id":"8dc090ea-4eae-453a-9380-47a38e35e7b3","version":5,"content_hash":"v3:86d877f219e2131f05dd5b37c5e329c71c7b8ec4:dd21f2fcfeaa0b28394807a04a79036004726ba2f79fc29fd9ba3d650120e9d8:fba5cbe97e90c985c44a73469564413e386a6d158a1b118eba686c9ece2608f1:736b696c6c732f7369636b6e33332f6177732d69616d2d626573742d707261637469636573:f9a83f0a14e2cbfe1dfb078355a1d592","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static alerts are false positives caused by Markdown fences, official AWS links, documentation ranges, and read-only audit examples. The access-key creation example has a real cloud-side effect, and the predictable temporary MFA QR path can expose sensitive bootstrap material.","remediation":[{"issue":"The access-key rotation example creates a long-term AWS credential and retains its response in a shell variable.","severity":"high","suggestion":"Require explicit approval, store the secret in an approved secrets manager, verify application migration, and remove the shell variable after use."},{"issue":"The MFA bootstrap QR is written to the predictable shared path /tmp/qr.png.","severity":"medium","suggestion":"Create a private temporary directory, enforce restrictive permissions, avoid reusable filenames, and delete the QR immediately after enrollment."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":69,"line_start":42},{"file":"SKILL.md","line_end":73,"line_start":69},{"file":"SKILL.md","line_end":95,"line_start":73},{"file":"SKILL.md","line_end":99,"line_start":95},{"file":"SKILL.md","line_end":128,"line_start":99},{"file":"SKILL.md","line_end":132,"line_start":128},{"file":"SKILL.md","line_end":157,"line_start":132},{"file":"SKILL.md","line_end":163,"line_start":157},{"file":"SKILL.md","line_end":187,"line_start":163},{"file":"SKILL.md","line_end":191,"line_start":187},{"file":"SKILL.md","line_end":207,"line_start":191},{"file":"SKILL.md","line_end":211,"line_start":207},{"file":"SKILL.md","line_end":230,"line_start":211},{"file":"SKILL.md","line_end":234,"line_start":230},{"file":"SKILL.md","line_end":253,"line_start":234},{"file":"SKILL.md","line_end":287,"line_start":253},{"file":"SKILL.md","line_end":366,"line_start":287},{"file":"SKILL.md","line_end":388,"line_start":366},{"file":"SKILL.md","line_end":391,"line_start":388},{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":54,"line_start":53},{"file":"SKILL.md","line_end":64,"line_start":63},{"file":"SKILL.md","line_end":82,"line_start":81},{"file":"SKILL.md","line_end":84,"line_start":83},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":146,"line_start":145},{"file":"SKILL.md","line_end":69,"line_start":42},{"file":"SKILL.md","line_end":95,"line_start":73},{"file":"SKILL.md","line_end":128,"line_start":99},{"file":"SKILL.md","line_end":157,"line_start":132}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":395,"line_start":395},{"file":"SKILL.md","line_end":396,"line_start":396},{"file":"SKILL.md","line_end":397,"line_start":397},{"file":"SKILL.md","line_end":245,"line_start":245},{"file":"SKILL.md","line_end":246,"line_start":246}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":93,"line_start":93}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":115,"line_start":115}]}],"critical_findings":[],"high_findings":[{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":119,"line_start":119}],"confidence":0.94,"description":"NEW_KEY=$(aws iam create-access-key --user-name \"$USER\")","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This command creates a new long-term AWS access key and places the credential response in a shell variable. Execution changes the account and produces secret material."}],"medium_findings":[{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":93,"line_start":93}],"confidence":0.9,"description":"--outfile /tmp/qr.png \\","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The example writes an MFA bootstrap QR to predictable /tmp/qr.png. On shared systems, insecure permissions or filename reuse can expose the MFA seed."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":403,"audit_model":"codex","audited_at":"2026-07-23T20:59:16.072+00:00","created_at":"2026-07-26T02:30:09.823991+00:00","static_findings":[{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":69,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":73,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":95,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":99,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":128,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":132,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":157,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":163,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":187,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":191,"severity":"medium","line_start":187},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":207,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":211,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":230,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":234,"severity":"medium","line_start":230},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":253,"severity":"medium","line_start":234},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":287,"severity":"medium","line_start":253},{"id":"external_commands:SKILL.md:287:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":366,"severity":"medium","line_start":287},{"id":"external_commands:SKILL.md:366:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":388,"severity":"medium","line_start":366},{"id":"external_commands:SKILL.md:388:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":391,"severity":"medium","line_start":388},{"id":"external_commands:SKILL.md:51:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"version=$(aws iam get-policy --policy-arn \"$arn\" \\","category":"external_commands","line_end":52,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:53:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"doc=$(aws iam get-policy-version --policy-arn \"$arn\" \\","category":"external_commands","line_end":54,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:63:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"policies=$(aws iam list-user-policies --user-name \"$user\" \\","category":"external_commands","line_end":64,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:81:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"version=$(aws iam get-policy --policy-arn \"$arn\" \\","category":"external_commands","line_end":82,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:83:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"doc=$(aws iam get-policy-version --policy-arn \"$arn\" \\","category":"external_commands","line_end":84,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:107:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"age_days=$(( ($(date +%s) - $(date -d \"$create_date\" +%s)) / 86400 ))","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:119:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"NEW_KEY=$(aws iam create-access-key --user-name \"$USER\")","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:145:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"trust=$(aws iam get-role --role-name \"$role\" \\","category":"external_commands","line_end":146,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:42:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":69,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:73:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":95,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:99:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":128,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:132:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":157,"severity":"medium","line_start":132},{"id":"network:SKILL.md:395:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)","category":"network","line_end":395,"severity":"low","line_start":395},{"id":"network:SKILL.md:396:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [IAM Policy Simulator](https://policysim.aws.amazon.com/)","category":"network","line_end":396,"severity":"low","line_start":396},{"id":"network:SKILL.md:397:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [IAM Access Analyzer](https://aws.amazon.com/iam/features/analyze-access/)","category":"network","line_end":397,"severity":"low","line_start":397},{"id":"network:SKILL.md:245:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"\"203.0.113.0/24\",","category":"network","line_end":245,"severity":"medium","line_start":245},{"id":"network:SKILL.md:246:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"\"198.51.100.0/24\"","category":"network","line_end":246,"severity":"medium","line_start":246},{"id":"filesystem:SKILL.md:93:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"--outfile /tmp/qr.png \\","category":"filesystem","line_end":93,"severity":"medium","line_start":93},{"id":"env_access:SKILL.md:115:aws-credential-environment-variables","file":"SKILL.md","pattern":"AWS credential environment variables","snippet":"OLD_KEY=\"<AWS_ACCESS_KEY_ID>\"","category":"env_access","line_end":115,"severity":"high","line_start":115},{"id":"blocker:SKILL.md:23:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid wildcard (*) permissions","category":"blocker","line_end":23,"severity":"low","line_start":23},{"id":"blocker:SKILL.md:54:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--version-id \"$version\" --query 'PolicyVersion.Document')","category":"blocker","line_end":54,"severity":"low","line_start":54},{"id":"blocker:SKILL.md:84:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--version-id \"$version\" --query 'PolicyVersion.Document')","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"blocker:SKILL.md:106:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"while read key_id create_date status; do","category":"blocker","line_end":106,"severity":"low","line_start":106},{"id":"blocker:SKILL.md:109:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"echo \"$user: Key $key_id is $age_days days old\"","category":"blocker","line_end":109,"severity":"low","line_start":109},{"id":"blocker:SKILL.md:121:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"echo \"aws iam delete-access-key --user-name $USER --access-key-id $OLD_KEY\"","category":"blocker","line_end":121,"severity":"low","line_start":121},{"id":"blocker:SKILL.md:126:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--access-key-id \"$OLD_KEY\" \\","category":"blocker","line_end":126,"severity":"low","line_start":126}],"finding_verdicts":[{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Line 42 is a Markdown bash fence, not Ruby or shell backtick execution. The enclosed commands are documented IAM audit examples.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"Line 69 only closes a Markdown code block. It does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"Line 73 opens a documented bash block for MFA checks. Markdown fence backticks are not executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"Line 95 closes a Markdown code block. No backtick command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"Line 99 opens a Markdown bash example. The fence itself cannot execute the access-key management commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"Line 128 only closes the access-key example block. It is not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"Line 132 opens a Markdown bash block for role analysis. The detected backticks are documentation delimiters.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"Line 157 closes a Markdown block. It contains no Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"Line 163 opens a JSON policy example. Markdown fence backticks are inert content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"Line 187 closes a JSON example block and does not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"Line 191 opens an IAM policy JSON example. It is documentation, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"Line 207 only closes a JSON code block. No executable backtick expression exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"Line 211 opens a time-based IAM policy example. The Markdown fence is not executable.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","reason":"Line 230 closes a JSON example and performs no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","reason":"Line 234 opens an IP condition policy example. Its backticks only delimit Markdown.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","reason":"Line 253 closes a JSON code block. It is not shell or Ruby execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:287:ruby-shell-backtick-execution","reason":"Line 287 opens a Python example. Markdown fence backticks do not run the Boto3 code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:366:ruby-shell-backtick-execution","reason":"Line 366 closes the Python example. No shell backtick execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:388:ruby-shell-backtick-execution","reason":"Line 388 opens a Markdown bash block containing example Kiro CLI prompts. The fence itself is inert.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:shell-command-substitution","reason":"The substitution captures a read-only AWS policy version query. The policy ARN is quoted and comes from the preceding AWS list operation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:53:shell-command-substitution","reason":"The substitution retrieves a policy document for auditing with quoted ARN and version arguments. No untrusted shell evaluation or mutation is shown.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:63:shell-command-substitution","reason":"This read-only command captures inline policy names for each AWS-provided username. The username argument is quoted and not evaluated as shell code.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:81:shell-command-substitution","reason":"The command performs a read-only policy metadata lookup for an MFA audit. Its variable argument is quoted.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:83:shell-command-substitution","reason":"The command retrieves a policy document to check an MFA condition. Quoted values prevent shell word splitting or command injection.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:107:shell-command-substitution","reason":"The nested date substitutions calculate access-key age from AWS metadata. The date value is quoted, and the command does not alter the system.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:119:shell-command-substitution","reason":"This command creates a new long-term AWS access key and places the credential response in a shell variable. Execution changes the account and produces secret material.","verdict":"confirmed","severity":"high","confidence":0.94},{"id":"external_commands:SKILL.md:145:shell-command-substitution","reason":"The substitution performs a read-only role trust-policy query. The role name is quoted and comes from the AWS role listing.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:42:template-literal-with-command-substitution","reason":"The matched text is a fenced Markdown bash example, not a programming-language template literal. No template evaluation context exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:template-literal-with-command-substitution","reason":"The matched range is Markdown documentation containing shell examples. It is not a template literal evaluated by application code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:template-literal-with-command-substitution","reason":"The detected backticks delimit a Markdown block. They do not interpolate or execute the shell substitutions inside it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:132:template-literal-with-command-substitution","reason":"The range is a fenced bash example for IAM role analysis. No executable template-literal context is present.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:395:hardcoded-url","reason":"This is a visible link to official AWS IAM best-practices documentation. The skill does not automatically request or transmit data to it.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:396:hardcoded-url","reason":"This is a visible link to the official AWS IAM Policy Simulator. It is a reference, not an automatic network call.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:397:hardcoded-url","reason":"This is a visible official AWS Access Analyzer reference. No data transmission or hidden network behavior is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:245:hardcoded-ip-address","reason":"203.0.113.0/24 is an IANA TEST-NET documentation range used as placeholder policy data. It is not an operational endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:246:hardcoded-ip-address","reason":"198.51.100.0/24 is an IANA TEST-NET documentation range. Its use in an example IAM condition does not create network activity.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:93:temp-directory-access","reason":"The example writes an MFA bootstrap QR to predictable /tmp/qr.png. On shared systems, insecure permissions or filename reuse can expose the MFA seed.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"env_access:SKILL.md:115:aws-credential-environment-variables","reason":"OLD_KEY is a shell variable assigned a literal placeholder access-key ID. The example does not read AWS credential environment variables or include a real secret.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:23:system-reconnaissance","reason":"This line is prose advising users to avoid wildcard IAM permissions. It performs no system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:54:system-reconnaissance","reason":"This line completes a documented, read-only AWS policy-version query. It does not collect host or system details.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:84:system-reconnaissance","reason":"This line completes a read-only IAM policy query used to inspect MFA conditions. It is not host reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:106:system-reconnaissance","reason":"The loop parses access-key metadata returned by an explicit AWS audit command. It does not probe the local system.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:109:system-reconnaissance","reason":"This line prints an age finding from the IAM audit. It neither discovers system information nor sends the result externally.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:121:system-reconnaissance","reason":"The line prints a suggested AWS access-key deletion command but does not execute it. It is not system reconnaissance.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:126:system-reconnaissance","reason":"This line supplies the access-key ID to an explicit IAM deactivation example. The action is operational guidance, not reconnaissance.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":"86d877f219e2131f05dd5b37c5e329c71c7b8ec4","subject_content_hash":"dd21f2fcfeaa0b28394807a04a79036004726ba2f79fc29fd9ba3d650120e9d8","subject_tree_hash":"fba5cbe97e90c985c44a73469564413e386a6d158a1b118eba686c9ece2608f1","subject_plugin_path":"skills/sickn33/aws-iam-best-practices","audit_payload_hash":"f9a83f0a14e2cbfe1dfb078355a1d592","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"86d877f219e2131f05dd5b37c5e329c71c7b8ec4","contentHash":"dd21f2fcfeaa0b28394807a04a79036004726ba2f79fc29fd9ba3d650120e9d8","treeHash":"fba5cbe97e90c985c44a73469564413e386a6d158a1b118eba686c9ece2608f1","pluginPath":"skills/sickn33/aws-iam-best-practices","auditPayloadHash":"f9a83f0a14e2cbfe1dfb078355a1d592"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-aws-iam-best-practices/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}