Agent skill

AWS V4 Signing Custom Headers Gcs

by divinevideo in divinevideo/divine-mobile

Add custom metadata headers (x-amz-meta-) to AWS v4 signed requests for GCS S3-compatible API.

MPL-2.0Auto-check passedBackend & APIs

Install AWS V4 Signing Custom Headers Gcs

skills CLI
$ npx skills add divinevideo/divine-mobile --skill aws-v4-signing-custom-headers-gcs -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install divinevideo/divine-mobile aws-v4-signing-custom-headers-gcs --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/divinevideo/divine-mobile.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/aws-v4-signing-custom-headers-gcs .claude/skills/aws-v4-signing-custom-headers-gcs && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
aws-v4-signing-custom-headers-gcs
GitHub stars
266
Token cost
~1k tokens
SKILL.md length
213 words
Files
1
Skills in repo
103
Repo updated
First seen
Licence
MPL-2.0

At a glance

Add custom metadata headers (x-amz-meta-) to AWS v4 signed requests for GCS S3-compatible API.

  • Works in 3 steps: Canonical Headers (alphabetically sorted) → Signed Headers List → Complete Example (Rust)
  • Adding custom metadata to GCS uploads via S3 API
  • SKILL.md covers Problem, Context / Trigger Conditions, Solution and Verification, plus 3 more sections
  • Calls gsutil and aws; reaches storage.googleapis.com

What it does

AWS V4 Signing Custom Headers Gcs is an agent skill from divinevideo/divine-mobile. Add custom metadata headers (x-amz-meta-) to AWS v4 signed requests for GCS S3-compatible API. Use when: (1) Adding custom metadata to GCS uploads via S3 API, (2) Getting signature mismatch errors after adding new headers, (3) x-amz-meta- headers being ignored or causing 403 errors. Custom headers MUST be included in canonical headers and signed headers list.

Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering File uploads and storage. It works with Amazon Web Services. The licence is MPL-2.0.

When your agent uses it

  • Adding custom metadata to GCS uploads via S3 API
  • Getting signature mismatch errors after adding new headers
  • X-amz-meta- headers being ignored
  • Causing 403 errors

Example prompts

  • “/aws-v4-signing-custom-headers-gcs”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Canonical Headers (alphabetically sorted)
  2. Signed Headers List
  3. Complete Example (Rust)

What it can do on your machine

Read from SKILL.md and the folder at commit a1a9a8a. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gsutil
    • aws

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • storage.googleapis.com

    Also links to:

    • cloud.google.com
    • docs.aws.amazon.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

AWS V4 Signing Custom Headers Gcs loads about 1k tokens when it runs. Until then it costs about 99 tokens; SKILL.md has 213 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~99
When it runs · the whole SKILL.md, loaded when a task matches
~1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from divinevideo/divine-mobile at commit a1a9a8a, republished under its MPL-2.0 licence (© divinevideo). 213 words, ~1,023 tokens.

Download SKILL.mdSave it as .claude/skills/aws-v4-signing-custom-headers-gcs/SKILL.md (or your agent's skills folder).
name
aws-v4-signing-custom-headers-gcs
description
Add custom metadata headers (x-amz-meta-*) to AWS v4 signed requests for GCS S3-compatible API. Use when: (1) Adding custom metadata to GCS uploads via S3 API, (2) Getting signature mismatch errors after adding new headers, (3) x-amz-meta-* headers being ignored or causing 403 errors. Custom headers MUST be included in canonical headers and signed headers list.
author
Claude Code
version
1.0.0
date
2026-01-20

AWS v4 Signing with Custom Metadata Headers for GCS

Problem

When adding custom metadata headers (x-amz-meta-*) to GCS S3-compatible API requests, the requests fail with signature mismatch errors. The headers must be properly included in the AWS v4 signature calculation.

Context / Trigger Conditions

  • Using GCS S3-compatible XML API (not the native JSON API)
  • Adding x-amz-meta-* headers for object metadata
  • Error: "SignatureDoesNotMatch" or 403 Forbidden after adding headers
  • Headers work with unsigned requests but fail with AWS v4 signing
  • HMAC credentials configured for GCS interoperability

Solution

Custom headers must be included in both the canonical headers and the signed headers list, sorted alphabetically:

1. Canonical Headers (alphabetically sorted)
rust
let canonical_headers = format!(
    "host:{}\nx-amz-content-sha256:{}\nx-amz-date:{}\nx-amz-meta-owner:{}\n",
    host, payload_hash, amz_date, owner  // Note: alphabetical order!
);
2. Signed Headers List
rust
let signed_headers = "host;x-amz-content-sha256;x-amz-date;x-amz-meta-owner";
3. Complete Example (Rust)
rust
fn sign_request_with_owner(
    req: &mut Request,
    config: &GCSConfig,
    payload_hash: Option<String>,
    owner: &str
) -> Result<()> {
    // Set headers first
    req.set_header("x-amz-date", &amz_date);
    req.set_header("x-amz-content-sha256", &payload_hash);
    req.set_header("x-amz-meta-owner", owner);  // Custom metadata

    // Canonical headers - MUST be alphabetically sorted
    let signed_headers = "host;x-amz-content-sha256;x-amz-date;x-amz-meta-owner";
    let canonical_headers = format!(
        "host:{}\nx-amz-content-sha256:{}\nx-amz-date:{}\nx-amz-meta-owner:{}\n",
        host, payload_hash, amz_date, owner
    );

    // Rest of AWS v4 signing...
    let canonical_request = format!(
        "{}\n{}\n{}\n{}\n{}\n{}",
        method, uri, query, canonical_headers, signed_headers, payload_hash
    );

    // Sign and add Authorization header...
}

Verification

After uploading, verify metadata is present:

bash
gsutil stat gs://bucket/object-name
# Should show:
#     Metadata:
#         owner: <value>

Or via S3 API:

bash
aws s3api head-object --bucket bucket --key object-name --endpoint-url https://storage.googleapis.com

Example

Before (broken) - header not in signature:

rust
let signed_headers = "host;x-amz-content-sha256;x-amz-date";  // Missing x-amz-meta-owner
req.set_header("x-amz-meta-owner", owner);  // Header added but not signed
// Result: 403 SignatureDoesNotMatch

After (working) - header properly signed:

rust
let signed_headers = "host;x-amz-content-sha256;x-amz-date;x-amz-meta-owner";  // Included!
req.set_header("x-amz-meta-owner", owner);
// Include in canonical_headers too
// Result: 200 OK, metadata visible in GCS

Notes

  • Header names are case-insensitive but conventionally lowercase in canonical form
  • The semicolon-separated signed headers list must match the newline-separated canonical headers
  • For GCS, the metadata appears as Metadata: key: value in gsutil stat output
  • When using the native GCS JSON API, use the metadata object field instead
  • Multiple custom headers can be added - just ensure all are in canonical/signed lists

References

© divinevideo, MPL-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/aws-v4-signing-custom-headers-gcs of divinevideo/divine-mobile.

Open the folder on GitHubat commit a1a9a8a

Compare with similar skills

AWS V4 Signing Custom Headers Gcs next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

AWS V4 Signing Custom Headers Gcs compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
AWS V4 Signing Custom Headers Gcs this skilldivinevideo/divine-mobile266—~1kAutomated safety check: PassMPL-2.0
FoundatioFoundatioFx/Foundatio2.1k—~3.9kAutomated safety check: PassApache-2.0
PhidownESA-PhiLab/phidown105—~1kAutomated safety check: PassApache-2.0
Fftiers Opsborisachen/fftiers202—~1.8kAutomated safety check: WarnNone
Processing S3 Uploads With Step Functionsaws/agent-toolkit-for-aws2.8k—~4kAutomated safety check: PassApache-2.0
API Keysaws-samples/sample-host-openclaw-on-amazon-bedrock-agentcore177—~825Automated safety check: PassMIT-0

Similar skills

  • Foundatio

    FoundatioFx/Foundatio

    A skill your agent uses when working with Foundatio infrastructure abstractions for .NET -- caching, queuing, messaging, file storage, distributed locking, or background jobs.

    2.1k GitHub stars~3.9k tokensUpdated 2 days ago
    Backend & APIsAuto-check passed
  • Phidown

    ESA-PhiLab/phidown

    Search, filter, download, and analyze Copernicus Data Space products with the phidown project.

    105 GitHub stars~1k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed
  • Fftiers Ops

    borisachen/fftiers

    Operate the borischen.co fftiers pipeline — season rollover, run main.R, S3 deploy from Workbench or EC2.

    202 GitHub stars~1.8k tokensUpdated 1 mo ago
    Backend & APIsAuto-check: warnings
  • Official

    Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size.

    2.8k GitHub stars~4k tokensUpdated yesterday
    Backend & APIsAuto-check passed
  • API Keys

    aws-samples/sample-host-openclaw-on-amazon-bedrock-agentcore

    Official

    Dual-mode API key storage — native file-based or AWS Secrets Manager.

    177 GitHub stars~825 tokensUpdated 13 days ago
    Backend & APIsAuto-check passed
  • Neon Functions

    neondatabase/agent-skills

    Official

    Long-running, serverless Node.js HTTP functions deployed onto your Neon branch, with DATABASEURL injected automatically and compute that runs next to your data.

    100 GitHub stars~12k tokensUpdated 2 days ago
    Backend & APIsAuto-check: notes

More from divinevideo/divine-mobile

All 103 skills in this repo
  • Fix ArgoCD ExternalSecret deployment failing with "namespace X is not permitted in project Y".

    266 GitHub stars~931 tokensUpdated today
    Auto-check passed
  • Art Direct

    divinevideo/divine-mobile

    Art direction for any content — reads text, PDF, Word, HTML, PPT, then proposes 2-3 creative directions with photography style, mood, and visual language.

    266 GitHub stars~4.8k tokensUpdated today
    Auto-check passed
  • Async Await Null Race Condition

    divinevideo/divine-mobile

    Fix "Null check operator used on a null value" errors when an object is set to null during an async await.

    266 GitHub stars~881 tokensUpdated today
    Auto-check passed
  • Bash Herestring Newline Secrets

    divinevideo/divine-mobile

    Fix password/secret authentication failures caused by trailing newlines when creating Google Cloud secrets (or similar) with bash here-strings.

    266 GitHub stars~791 tokensUpdated today
    Auto-check passed
  • Fix silent video/media processing failures caused by URL extraction code that filters on file extensions (.mp4, .webm, .webp).

    266 GitHub stars~1.1k tokensUpdated today
    Auto-check passed
  • Certmanager Dns01 Gke Private Cluster

    divinevideo/divine-mobile

    Fix cert-manager DNS01 ACME challenges stuck in "pending" state with "DNS record not yet propagated" inside GKE private clusters, even when TXT records exist in Cloudflare DNS.

    266 GitHub stars~1.8k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about AWS V4 Signing Custom Headers Gcs

What does AWS V4 Signing Custom Headers Gcs do?

Add custom metadata headers (x-amz-meta-) to AWS v4 signed requests for GCS S3-compatible API. AWS V4 Signing Custom Headers Gcs is an agent skill from divinevideo/divine-mobile. Add custom metadata headers (x-amz-meta-) to AWS v4 signed requests for GCS S3-compatible API.

When should I use AWS V4 Signing Custom Headers Gcs?

AWS V4 Signing Custom Headers Gcs fits situations like: adding custom metadata to GCS uploads via S3 API; getting signature mismatch errors after adding new headers; X-amz-meta- headers being ignored; causing 403 errors.

How do I install AWS V4 Signing Custom Headers Gcs in Claude Code?

Run `npx skills add divinevideo/divine-mobile --skill aws-v4-signing-custom-headers-gcs -a claude-code`. Or copy the skill folder (.agents/skills/aws-v4-signing-custom-headers-gcs in divinevideo/divine-mobile) into .claude/skills/aws-v4-signing-custom-headers-gcs in your project. Claude Code loads it when a task matches its description.

How do I install AWS V4 Signing Custom Headers Gcs in Codex?

Run `npx skills add divinevideo/divine-mobile --skill aws-v4-signing-custom-headers-gcs -a codex`. Or copy the skill folder (.agents/skills/aws-v4-signing-custom-headers-gcs in divinevideo/divine-mobile) into .agents/skills/aws-v4-signing-custom-headers-gcs in your project. Codex loads it when a task matches its description.

Can I use AWS V4 Signing Custom Headers Gcs in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add divinevideo/divine-mobile --skill aws-v4-signing-custom-headers-gcs -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/aws-v4-signing-custom-headers-gcs, .gemini/skills/aws-v4-signing-custom-headers-gcs, .github/skills/aws-v4-signing-custom-headers-gcs and .opencode/skills/aws-v4-signing-custom-headers-gcs in your project.

What does AWS V4 Signing Custom Headers Gcs need to run?

Going by SKILL.md and its folder, AWS V4 Signing Custom Headers Gcs needs the command-line tools its instructions call (gsutil and aws).

Does AWS V4 Signing Custom Headers Gcs access the network?

SKILL.md names 3 domains. In commands or code: storage.googleapis.com; the agent is likely to contact it when it follows the instructions. As links in the text: cloud.google.com and docs.aws.amazon.com. This is read from the text; nothing was executed.

Is AWS V4 Signing Custom Headers Gcs safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does AWS V4 Signing Custom Headers Gcs use?

AWS V4 Signing Custom Headers Gcs is published under the MPL-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does AWS V4 Signing Custom Headers Gcs use?

About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to AWS V4 Signing Custom Headers Gcs?

Skills that share tags, products or a category with AWS V4 Signing Custom Headers Gcs: Foundatio (FoundatioFx/Foundatio, 2.1k stars), Phidown (ESA-PhiLab/phidown, 105 stars), Fftiers Ops (borisachen/fftiers, 202 stars) and Processing S3 Uploads With Step Functions (aws/agent-toolkit-for-aws, 2.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains AWS V4 Signing Custom Headers Gcs?

divinevideo (a GitHub organization) maintains it in divinevideo/divine-mobile, which has 266 GitHub stars. The repository holds 103 skills in this directory. The repository was last updated on October 11, 2026.

Source: divinevideo/divine-mobile on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.