Spend Analyzer

Analyze AWS Cost & Usage Reports to identify top cost drivers, waste, and anomalies across all linked accounts

This skill appears to do what it says: analyze exported AWS billing data. Before using it, consider the following: (1) The skill is from an unknown source with no homepage—only proceed if you trust the environment or author. (2) Do not paste AWS credentials, access keys, or secrets; follow the skill's instruction to confirm pasted data contains no credentials. Billing exports can still include sensitive metadata (account IDs, resource ARNs, tags); sanitize or redact anything you don't want shared. (3) The header lists a 'bash' tool while the instructions claim not to execute CLI commands—ask the skill owner or runtime whether the assistant will run commands on your behalf; prefer running aws CLI locally and then pasting sanitized output rather than granting remote execution. (4) If you need stronger assurance, request provenance (who authored/published the skill) or a checksum/signature for the SKILL.md. Providing those will raise confidence in the skill.

Type: OpenClaw Skill Name: spend-analyzer Version: 1.0.0 The skill declares `tools: bash` in `SKILL.md`, granting the AI agent shell execution capabilities. This directly contradicts the explicit instruction within the same file: 'This skill is instruction-only. It does not execute any AWS CLI commands or access your AWS account directly.' While the skill itself does not instruct malicious actions, this contradiction creates a significant prompt injection vulnerability, as a malicious user could potentially bypass the 'instruction-only' directive and coerce the agent into executing arbitrary shell commands, including the AWS CLI examples provided for the user. This represents a risky capability without clear malicious intent from the skill author, but a critical vulnerability.