Official agent skill

Enrich With AWS Security Agent

OfficialApache-2.0Auto-check passedSecurity

Install Enrich With AWS Security Agent

skills CLI

$ npx skills add aws/tools-for-devops-agent --skill enrich-with-aws-security-agent -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install aws/tools-for-devops-agent enrich-with-aws-security-agent --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/aws/tools-for-devops-agent.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/enrich-with-aws-security-agent .claude/skills/enrich-with-aws-security-agent && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "enrich-with-aws-security-agent" agent skill from https://github.com/aws/tools-for-devops-agent/tree/main/skills/enrich-with-aws-security-agent into .claude/skills/enrich-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "enrich-with-aws-security-agent", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/aws/tools-for-devops-agent/tree/main/skills/enrich-with-aws-security-agent

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add aws/tools-for-devops-agent --skill enrich-with-aws-security-agent -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install aws/tools-for-devops-agent enrich-with-aws-security-agent --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aws/tools-for-devops-agent.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/enrich-with-aws-security-agent .agents/skills/enrich-with-aws-security-agent && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "enrich-with-aws-security-agent" agent skill from https://github.com/aws/tools-for-devops-agent/tree/main/skills/enrich-with-aws-security-agent into .agents/skills/enrich-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "enrich-with-aws-security-agent", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add aws/tools-for-devops-agent --skill enrich-with-aws-security-agent -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install aws/tools-for-devops-agent enrich-with-aws-security-agent --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aws/tools-for-devops-agent.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/enrich-with-aws-security-agent .cursor/skills/enrich-with-aws-security-agent && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "enrich-with-aws-security-agent" agent skill from https://github.com/aws/tools-for-devops-agent/tree/main/skills/enrich-with-aws-security-agent into .cursor/skills/enrich-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "enrich-with-aws-security-agent", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/aws/tools-for-devops-agent.git --path skills/enrich-with-aws-security-agent

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add aws/tools-for-devops-agent --skill enrich-with-aws-security-agent -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install aws/tools-for-devops-agent enrich-with-aws-security-agent --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aws/tools-for-devops-agent.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/enrich-with-aws-security-agent .gemini/skills/enrich-with-aws-security-agent && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "enrich-with-aws-security-agent" agent skill from https://github.com/aws/tools-for-devops-agent/tree/main/skills/enrich-with-aws-security-agent into .gemini/skills/enrich-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "enrich-with-aws-security-agent", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install aws/tools-for-devops-agent enrich-with-aws-security-agent

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add aws/tools-for-devops-agent --skill enrich-with-aws-security-agent -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/aws/tools-for-devops-agent.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/enrich-with-aws-security-agent .github/skills/enrich-with-aws-security-agent && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "enrich-with-aws-security-agent" agent skill from https://github.com/aws/tools-for-devops-agent/tree/main/skills/enrich-with-aws-security-agent into .github/skills/enrich-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "enrich-with-aws-security-agent", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add aws/tools-for-devops-agent --skill enrich-with-aws-security-agent -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install aws/tools-for-devops-agent enrich-with-aws-security-agent --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aws/tools-for-devops-agent.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/enrich-with-aws-security-agent .opencode/skills/enrich-with-aws-security-agent && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "enrich-with-aws-security-agent" agent skill from https://github.com/aws/tools-for-devops-agent/tree/main/skills/enrich-with-aws-security-agent into .opencode/skills/enrich-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "enrich-with-aws-security-agent", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: enrich-with-aws-security-agent
GitHub stars: 103
Token cost: ~1.1k tokens
SKILL.md length: 430 words
Files: 9
Skills in repo: 31
Repo updated: Oct 9, 2026
First seen: Oct 8, 2026
Licence: Apache-2.0

At a glance

Works in 5 steps: Identify the relevant CloudWatch log… → Query the Security Agent logs using… → Extract actionable details from the… → …
Tasks that involve Cloud security
SKILL.md covers When to Use — AUTOMATIC…, Overview, Steps and Example Log Query for Specific…, plus 1 more section
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Enrich With AWS Security Agent is an agent skill from aws/tools-for-devops-agent, published by the product's own GitHub organization. Automatically load this skill when investigating application outages, service degradation, or errors that could have security-related root causes — including unexplained downtime, authentication or authorization failures, injection attacks, data exposure, or suspicious application behavior. Query AWS Security Agent CloudWatch logs to retrieve detailed code review findings with actionable, low-level details (file, line number, vulnerability type) that customers can directly fix.

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 9 other files (for example `.skilleval.yaml`, `CHANGELOG.md` and `README.md`).

It sits in Security, covering Cloud security, Incident response and Root cause analysis. It works with Amazon Web Services. The repository describes itself as: Open-source tools for AWS DevOps Agent - extend DevOps Agent with ready-to-use skills, custom agents, and other tools, for incident response, root cause analysis, and operational…. The licence is Apache-2.0.

When your agent uses it

Tasks that involve Cloud security
Tasks that involve Incident response
Tasks that involve Root cause analysis

Example prompts

“/enrich-with-aws-security-agent”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

Identify the relevant CloudWatch log group for AWS Security Agent findings. Look for log groups with patterns like
Query the Security Agent logs using CloudWatch Logs Insights
Extract actionable details from the findings
Correlate findings with the incident by matching
Present findings to the customer with

What it can do on your machine

Read from SKILL.md and the folder at commit ddda70b. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Enrich With AWS Security Agent loads about 1.1k tokens when it runs. Until then it costs about 128 tokens; SKILL.md has 430 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~128
When it runs · the whole SKILL.md, loaded when a task matches: ~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from aws/tools-for-devops-agent at commit ddda70b, republished under its Apache-2.0 licence (© aws). 430 words, ~1,109 tokens.

Download SKILL.mdSave it as .claude/skills/enrich-with-aws-security-agent/SKILL.md (or your agent's skills folder). This skill also uses 8 other files; get the full folder from GitHub.

name: enrich-with-aws-security-agent
description: Automatically load this skill when investigating application outages, service degradation, or errors that could have security-related root causes — including unexplained downtime, authentication or authorization failures, injection attacks, data exposure, or suspicious application behavior. Query AWS Security Agent CloudWatch logs to retrieve detailed code review findings with actionable, low-level details (file, line number, vulnerability type) that customers can directly fix.
metadata.author: yakiratz-aws
metadata.version: 1.0.0
metadata.aws-devops-agent-skills.agent-t: Chat tasks, Incident RCA
metadata.aws-devops-agent-skills.aws-ser: Amazon CloudWatch, AWS Security Agent
metadata.aws-devops-agent-skills.technic: Security

Enriching Investigations with AWS Security Agent Findings

When to Use — AUTOMATIC ACTIVATION

Load this skill automatically when ANY of these conditions apply:

Application-Level Symptoms (even without explicit security context)

Application pages or endpoints are not loading or returning errors
Unexplained service outages with no recent deployments
Application behaving unexpectedly without clear infrastructure cause
Services returning 4xx/5xx errors without obvious resource exhaustion

Explicit Security Signals

Security vulnerabilities or misconfigurations mentioned
Suspicious code patterns or behaviors observed
Authentication or authorization failures
Injection vulnerabilities suspected (SQL, command, SSRF, etc.)
Sensitive data exposure concerns
Security-related errors in application logs
Findings that suggest code-level security issues

Key Insight

Many security issues (like SSRF, injection attacks, or compromised dependencies) manifest as application outages or errors rather than obvious security alerts. When an app stops working and there's no clear infrastructure cause (no deployments, no resource exhaustion, no config changes), always check for security issues.

Overview

AWS Security Agent is an AI-powered security service that performs automated code security reviews and penetration testing. Its findings are stored in CloudWatch Logs and provide detailed, actionable information about vulnerabilities including exact file locations, line numbers, and remediation guidance.

Steps

Identify the relevant CloudWatch log group for AWS Security Agent findings. Look for log groups with patterns like:
- /aws/securityagent/*
- Log groups containing "security-agent" or "securityagent" in the name

Query the Security Agent logs using CloudWatch Logs Insights:

fields @timestamp, @message
| filter @message like /finding|vulnerability|issue|risk/
| sort @timestamp desc
| limit 100

Extract actionable details from the findings:
- File path: The exact source file containing the vulnerability
- Line number: The specific line(s) of code affected
- Vulnerability type: Classification (e.g., SQL injection, XSS, SSRF, hardcoded secrets)
- Severity: Critical, High, Medium, Low
- Description: What the vulnerability is and why it's a risk
- Remediation: Suggested fix or mitigation
Correlate findings with the incident by matching:
- Affected services or components
- Timeframes (when the vulnerability was introduced vs. when the incident occurred)
- Code paths involved in the failing functionality
Present findings to the customer with:
- Clear identification of the vulnerable code location
- Explanation of how this vulnerability may relate to the incident
- Specific remediation steps they can take to fix the code

Show full SKILL.md (83 more words)Show less

Example Log Query for Specific Application

If investigating a specific application (e.g., "ssrf-demo", "orders", "account"):

fields @timestamp, @message
| filter @message like /ssrf|orders|account|vulnerability|finding|issue/
| sort @timestamp desc
| limit 50

Important Notes

AWS Security Agent API access may require additional IAM permissions. If API calls fail, fall back to the CloudWatch logs approach.
Always provide the exact file and line number when available — this is the key value for customers.
Link the security finding to the observed incident behavior when possible.
When in doubt, check security logs — it's better to rule out security issues than to miss them.

Files

SKILL.md and 8 other files in skills/enrich-with-aws-security-agent of aws/tools-for-devops-agent.

SKILL.md
.skilleval.yaml
CHANGELOG.md
README.md
evals/benchmark.json
evals/eval_queries.json
evals/evals.json
evals/report.json
evals/trigger_report.json

Open the folder on GitHubat commit ddda70b

Compare with similar skills

Enrich With AWS Security Agent next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Enrich With AWS Security Agent compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Enrich With AWS Security Agent this skillaws/tools-for-devops-agent	103	—	~1.1k	Automated safety check: Pass	Apache-2.0	yesterday
Conducting Cloud Incident Responsemukul975/Anthropic-Cybersecurity-Skills	34k	—	~3k	Automated safety check: Pass	Apache-2.0	1 mo ago
Cloud Auditbriiirussell/cybersecurity-skills	413	—	~1.3k	Automated safety check: Notes	MIT	4 mo ago
Security Setupluongnv89/skills	131	—	~4.5k	Automated safety check: Pass	MIT	today
AWS Security ArchitectureHack23/cia	239	—	~2.3k	Automated safety check: Pass	Apache-2.0	today
AWS Iamsickn33/agentic-awesome-skills	47k	2 repos	~3.4k	Automated safety check: Pass	MIT	yesterday

Similar skills

Conducting Cloud Incident Response
mukul975/Anthropic-Cybersecurity-Skills
Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic…
34k GitHub stars~3k tokensUpdated 1 mo ago
DevOps & CloudAuto-check passed
Cloud Audit
briiirussell/cybersecurity-skills
Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps.
413 GitHub stars~1.3k tokensUpdated 4 mo ago
SecurityAuto-check: notes
Security Setup
luongnv89/skills
Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.
131 GitHub stars~4.5k tokensUpdated today
SecurityAuto-check passed
AWS Security Architecture
Hack23/cia
AWS security best practices, VPC security, IAM, KMS, CloudTrail, GuardDuty for CIA platform deployment
239 GitHub stars~2.3k tokensUpdated today
SecurityAuto-check passed
AWS Iam
sickn33/agentic-awesome-skills
Manage IAM users, roles, and policies. An agent skill from sickn33/agentic-awesome-skills.
47k GitHub starsUsed in 2 repos~3.4k tokens
SecurityAuto-check passed
Auditing Cloud With Cis Benchmarks
mukul975/Anthropic-Cybersecurity-Skills
Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking…
34k GitHub stars~3k tokensUpdated 1 mo ago
SecurityAuto-check passed

More from aws/tools-for-devops-agent

All 31 skills in this repo

Aiml GPU Training Cluster Investigation
aws/tools-for-devops-agent
Official
A skill your agent uses for GPU training or inference clusters on SageMaker HyperPod (Slurm or EKS), ParallelCluster, or self-managed EC2/EKS GPU instances.
103 GitHub stars~5.4k tokensUpdated yesterday
Auto-check passed
AWS Health Events
aws/tools-for-devops-agent
Official
ALWAYS use this skill in the beginning of any incident investigation, root cause analysis, or operational troubleshooting.
103 GitHub stars~4.6k tokensUpdated yesterday
Auto-check passed
Database Migration Service Expertise
aws/tools-for-devops-agent
Official
AWS Database Migration Service (DMS) operational review and troubleshooting skill.
103 GitHub stars~3.4k tokensUpdated yesterday
Auto-check passed
Ecs Operation Review
aws/tools-for-devops-agent
Official
Performs a comprehensive Amazon ECS operations review across the 6 review pillars (Resiliency & HA, Observability, Security, Operations, Performance, Additional Analysis) using read-only AWS APIs…
103 GitHub stars~4.8k tokensUpdated yesterday
Auto-check passed
Rds Operation Review
aws/tools-for-devops-agent
Official
Comprehensive Amazon RDS and Aurora operational review aligned with the AWS Well-Architected Framework and RDS/Aurora best practices.
103 GitHub stars~4.8k tokensUpdated yesterday
Auto-check passed
Sagemaker AI Ops Review
aws/tools-for-devops-agent
Official
Amazon SageMaker AI Operational Review. An agent skill from aws/tools-for-devops-agent.
103 GitHub stars~3.9k tokensUpdated yesterday
Auto-check passed

Works with

Amazon Web Services

Questions about Enrich With AWS Security Agent

What does Enrich With AWS Security Agent do?

Automatically load this skill when investigating application outages, service degradation, or errors that could have security-related root causes — including unexplained downtime, authentication or…. Enrich With AWS Security Agent is an agent skill from aws/tools-for-devops-agent, published by the product's own GitHub organization. Automatically load this skill when investigating application outages, service degradation, or errors that could have security-related root causes — including unexplained downtime, authentication or authorization failures, injection attacks, data exposure, or suspicious application behavior.

When should I use Enrich With AWS Security Agent?

Enrich With AWS Security Agent fits situations like: tasks that involve Cloud security; tasks that involve Incident response; tasks that involve Root cause analysis.

How do I install Enrich With AWS Security Agent in Claude Code?

Run `npx skills add aws/tools-for-devops-agent --skill enrich-with-aws-security-agent -a claude-code`. Or copy the skill folder (skills/enrich-with-aws-security-agent in aws/tools-for-devops-agent) into .claude/skills/enrich-with-aws-security-agent in your project. Claude Code loads it when a task matches its description.

How do I install Enrich With AWS Security Agent in Codex?

Run `npx skills add aws/tools-for-devops-agent --skill enrich-with-aws-security-agent -a codex`. Or copy the skill folder (skills/enrich-with-aws-security-agent in aws/tools-for-devops-agent) into .agents/skills/enrich-with-aws-security-agent in your project. Codex loads it when a task matches its description.

Can I use Enrich With AWS Security Agent in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aws/tools-for-devops-agent --skill enrich-with-aws-security-agent -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/enrich-with-aws-security-agent, .gemini/skills/enrich-with-aws-security-agent, .github/skills/enrich-with-aws-security-agent and .opencode/skills/enrich-with-aws-security-agent in your project.

What does Enrich With AWS Security Agent need to run?

SKILL.md names no scripts, command-line tools or credentials: Enrich With AWS Security Agent is instructions for the agent only.

Does Enrich With AWS Security Agent access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Enrich With AWS Security Agent safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Enrich With AWS Security Agent use?

Enrich With AWS Security Agent is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Enrich With AWS Security Agent use?

About 1.1k tokens (SKILL.md is roughly 4.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Enrich With AWS Security Agent?

Skills that share tags, products or a category with Enrich With AWS Security Agent: Conducting Cloud Incident Response (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Cloud Audit (briiirussell/cybersecurity-skills, 413 stars), Security Setup (luongnv89/skills, 131 stars) and AWS Security Architecture (Hack23/cia, 239 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Enrich With AWS Security Agent?

aws (a GitHub organization, an official publisher) maintains it in aws/tools-for-devops-agent, which has 103 GitHub stars. The repository holds 31 skills in this directory. The repository was last updated on October 9, 2026.

Source: aws/tools-for-devops-agent on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Enrich With AWS Security Agent

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Enriching Investigations with AWS Security Agent Findings

When to Use — AUTOMATIC ACTIVATION

Application-Level Symptoms (even without explicit security context)

Explicit Security Signals

Key Insight

Overview

Steps

Example Log Query for Specific Application

Important Notes

Files

Compare with similar skills

Similar skills

More from aws/tools-for-devops-agent

Related

Questions about Enrich With AWS Security Agent