aws-samples

Use this skill to investigate and troubleshoot IAM Access Analyzer problems by analyzing analyzer creation, findings, external access, unused access, policy validation, policy generation, archive rules, and following structured runbooks. Activate when: analyzer creation failures, finding issues, external access detection problems, unused access analysis errors, policy validation failures, policy generation issues, archive rule problems, or the user says something is wrong with Access Analyzer.

Use this skill to investigate and troubleshoot AWS Certificate Manager (ACM) problems by analyzing certificate status, validation state, renewal configuration, and following structured runbooks. Activate when: DNS validation failures, email validation issues, certificate pending validation, auto-renewal failures, imported certificate expiry, CloudFront certificate errors (us-east-1 requirement), ALB/NLB certificate issues, API Gateway custom domain certificate problems, private CA issues, certificate import failures, chain of trust errors, key algorithm problems, certificate transparency logging concerns, in-use certificate deletion errors, orphaned certificates, or the user says something is wrong with ACM without naming specific symptoms.

Use this skill to investigate and troubleshoot Amazon Managed Grafana (AMG) problems by analyzing workspace configurations, data source connectivity, dashboard errors, authentication/SSO settings, alerting rules, plugin issues, API access, VPC connectivity, and IAM permissions using structured runbooks. Activate when: workspace creation or upgrade failures, SSO/SAML authentication issues, user/role mapping problems, CloudWatch or Prometheus data source errors, OpenSearch connectivity failures, cross-account data source access, dashboard rendering errors, query failures, dashboard import/export issues, alert rule failures, notification channel problems, plugin availability or configuration issues, VPC connectivity problems, private data source access, API key issues, Terraform/CloudFormation provisioning errors, or the user says something is wrong with Managed Grafana without naming specific symptoms.

Use this skill to investigate and troubleshoot Amazon Managed Service for Prometheus (AMP) problems by analyzing workspace configurations, remote write failures, query performance, alerting/ruler issues, ingestion problems, Prometheus-compatible API issues, IAM/SigV4 authentication, and collector configuration. Activate when: workspace creation failures, remote write errors, SigV4 authentication failures, ingestion rate limiting, high cardinality issues, query timeouts, PromQL errors, rule evaluation failures, SNS alert integration issues, ADOT collector problems, Prometheus server remote write configuration, EKS add-on issues, Grafana data source setup, VPC endpoint access, or the user says something is wrong with AMP without naming specific symptoms.

Use this skill to investigate and troubleshoot AWS Amplify Hosting problems by analyzing build failures, deployment issues, custom domains, backend environments, SSR configuration, access control, and CDN performance using structured runbooks. Activate when: build failures, build settings wrong, environment variables missing, deployment failures, branch configuration issues, PR preview problems, custom domain not working, SSL certificate errors, backend environment issues, API integration failures, SSR rendering errors, compute configuration problems, access control misconfigured, basic auth not working, CDN caching issues, rewrite rules not matching, or the user says something is wrong with Amplify without naming specific symptoms.

Use this skill to investigate and troubleshoot Amazon API Gateway problems including REST API, HTTP API, and WebSocket API types by analyzing configurations, integrations, authorizers, deployments, and following structured runbooks. Activate when: Lambda proxy errors, integration timeouts, 4xx/5xx errors, CORS failures, authorization issues (Lambda authorizer, Cognito, IAM), throttling, deployment failures, custom domain problems, WebSocket connection issues, mapping template errors, request validation failures, binary media type issues, stage variable problems, canary deployment issues, or the user says something is wrong with API Gateway without naming specific symptoms.

Use this skill to investigate and troubleshoot AWS AppConfig problems. Activate when: configuration deployment fails, feature flags not toggling, deployment strategy issues, configuration validation errors, environment or application creation failures, hosted configuration version problems, extension failures, or rollback issues.

Use this skill to investigate and troubleshoot AWS Application Discovery Service problems by analyzing agent deployment, agentless discovery, data collection, export, dependency mapping, and Athena integration using structured runbooks. Activate when: agent deployment failures, agentless collector issues, data collection problems, export failures, dependency mapping errors, Athena query issues, or the user says something is wrong with Application Discovery Service without naming specific symptoms.

Run the AI-DLC `application-design` stage (inception phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage application-design --single`: the engine emits one run-stage directive for application-design and its gate, the conductor runs it, then the single-stage run commits a synthetic-id pair and stops. The main workflow's Current Stage is never touched.

Run the AI-DLC `approval-handoff` stage (ideation phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage approval-handoff --single`: the engine emits one run-stage directive for approval-handoff and its gate, the conductor runs it, then the single-stage run commits a synthetic-id pair and stops. The main workflow's Current Stage is never touched.

Run the AI-DLC workflow with the bugfix scope baked in — no scope detection. Fix a specific bug. Packaging over `/aidlc --scope bugfix`, which works without this skill.

Run the AI-DLC `build-and-test` stage (construction phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage build-and-test --single`: the engine emits one run-stage directive for build-and-test and its gate, the conductor runs it, then the single-stage run commits a synthetic-id pair and stops. The main workflow's Current Stage is never touched.

Run the AI-DLC `ci-pipeline` stage (construction phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage ci-pipeline --single`: the engine emits one run-stage directive for ci-pipeline and its gate, the conductor runs it, then the single-stage run commits a synthetic-id pair and stops. The main workflow's Current Stage is never touched.

Run the AI-DLC `code-generation` stage (construction phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage code-generation --single`: the engine emits one run-stage directive for code-generation and its gate, the conductor runs it, then the single-stage run commits a synthetic-id pair and stops. The main workflow's Current Stage is never touched.

Run the AI-DLC `delivery-planning` stage (inception phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage delivery-planning --single`: the engine emits one run-stage directive for delivery-planning and its gate, the conductor runs it, then the single-stage run commits a synthetic-id pair and stops. The main workflow's Current Stage is never touched.

Run the AI-DLC `deployment-execution` stage (operation phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage deployment-execution --single`: the engine emits one run-stage directive for deployment-execution and its gate, the conductor runs it, then the single-stage run commits a synthetic-id pair and stops. The main workflow's Current Stage is never touched.

Generate a complete ECS Fargate SOCI (Seekable OCI) example with Terraform. Demonstrates lazy-loading container images for faster task startup using SOCI index v2 manifests. Includes a heavy ML inference container (PyTorch + FastAPI) with and without SOCI for comparison. Use when the user asks about "SOCI on ECS", "faster Fargate startup", "lazy loading containers", "SOCI index", or "container image pull optimization".

Guide customers from idea to AWS architecture with structured discovery, service selection, and Well-Architected review. Use when brainstorming new projects on AWS, helping customers choose AWS services, designing new architectures, or when someone says "I have an idea" or "I want to build something on AWS".

Guided migration from AWS App Runner to Amazon ECS Express Mode. Covers IAM setup, deployment, custom domains, DNS cutover, cost comparison, and troubleshooting. Use when the user asks to "migrate from App Runner", "move to ECS Express Mode", "replace App Runner", or mentions App Runner deprecation.

Azure to AWS migration guidance with service mappings, gotchas, and assessment. Use when migrating from Microsoft Azure, mapping Azure services to AWS equivalents, assessing Azure environments, or planning Azure-to-AWS migrations.

GCP to AWS migration guidance with service mappings, gotchas, and assessment. Use when migrating from Google Cloud Platform, mapping GCP services to AWS equivalents, assessing GCP environments, or planning GCP-to-AWS migrations.

Deep-dive into Amazon RDS and Aurora database design, engine selection, high availability, and operations. This skill should be used when the user asks to "design an RDS database", "choose between RDS and Aurora", "configure Aurora Serverless", "set up read replicas", "plan a database migration", "configure RDS Proxy", "tune database parameters", "set up Multi-AZ", "plan blue/green deployments", or mentions RDS, Aurora, Aurora Serverless v2, database failover, or relational database design on AWS.

Deep-dive into Amazon Bedrock AgentCore platform design, service selection, deployment, and production operations. This skill should be used when the user asks to "design an AgentCore architecture", "deploy agents on AgentCore", "configure AgentCore Runtime", "set up AgentCore Memory", "use AgentCore Gateway", "configure AgentCore Identity", "set up AgentCore Policy", "plan agent observability", "evaluate agent quality", "move agent PoC to production", or mentions AgentCore, AgentCore Runtime, AgentCore Memory, AgentCore Gateway, AgentCore Identity, AgentCore Policy, AgentCore Evaluations, AgentCore Code Interpreter, AgentCore Browser, A2A protocol, or multi-agent orchestration on AWS.

Design and review AWS architectures following Well-Architected Framework principles. Use when planning new infrastructure, reviewing existing architectures, evaluating trade-offs between AWS services, or when asked about AWS best practices.

생성 전(pre-generation) grounding 레이어. 온톨로지 엔티티(Spec/ADR/Deployment/Agent/Skill/Incident/Budget/Risk)를 작성하기 전에 지식 그래프를 질의해 기존 정의·enum·전례·결정 이유를 확인함으로써 drift를 소스에서 차단한다. adr-0001-graphify-knowledge-wiki 결정에 따라 Graphify(MIT)를 런타임 질의 substrate로 사용하며, Graphify 미가용 시 raw 스키마/docs 읽기로 graceful degradation 한다.

알려진 장애 패턴에 대해 사전 정의된 Runbook 기반 자동 복구를 실행한다. RCA 결과 또는 incident-response의 가설을 입력으로 받아 매칭되는 remediation playbook을 선택하고, 복구 전/후 상태를 검증하며, 실패 시 에스컬레이션한다. SEV2/3만 자동 복구 대상이며 SEV1은 사람 전용이다.

인시던트 발생 시 관련 메트릭·로그·이벤트·변경 이력을 자동 수집하고 인과 관계를 추론하여 근본 원인을 식별한다. 타임라인 기반 이벤트 상관관계 분석, 변경-장애 매핑, 의존성 그래프 탐색을 수행하며 RCA 보고서를 자동 생성한다.

SLI 메트릭을 자동 수집하여 SLO 대비 추적하고, Error Budget 소진율에 따라 배포 게이트를 제어한다. 번다운 차트 생성, 예측 기반 SLO 위반 사전 경고, Error Budget 정책(freeze/slow-down/normal) 자동 적용을 수행하며 continuous-eval의 품질 게이트를 보완한다.

CloudWatch 메트릭과 Prometheus 시계열 데이터에서 통계적 이상 징후를 자동 탐지하여 incident-response의 입력 소스로 제공한다. 베이스라인 학습(7일 이동 평균 + 3σ), 다변량 상관 분석, 계절성 보정을 수행하며 탐지된 anomaly를 severity 분류하여 알람을 생성한다.

과거 트래픽 패턴과 시계열 예측을 기반으로 리소스 수요를 사전 예측하고 스케일링을 권고한다. 시간대별/요일별 계절성 분석, 이벤트 기반 수요 급증 예측, 비용 대비 성능 최적 구성 제안을 수행하며 cost-governance와 연동하여 예산 범위 내 스케일링을 보장한다.

Self-host Langfuse v3.x on EKS (Web, API, Worker) with PostgreSQL, ClickHouse, Redis, and S3 backends. Wire an OpenTelemetry Collector pipeline that receives traces from vLLM, Bifrost/LiteLLM, and LangChain agents so token cost, latency, and quality scores are tracked end-to-end.

Ragas 기반 품질·안전 평가를 매 배포 직후와 매 1시간 cron으로 실행하여 faithfulness, answer relevance, context precision, toxicity, PII leakage 지표를 측정한다. Golden dataset 관리와 regression gate(baseline 대비 5%p 하락 시 차단)를 수행하며 autopilot-deploy의 canary gate에 사용된다.

EKS cost efficiency assessment — 6-dimension analysis, weighted 0-100 Cost Score, and dollar-quantified remediation report. Analyzes compute efficiency, Spot/Graviton adoption, networking, storage, observability, and idle resources. Triggers on cost audit, cost review, cost driver analysis, FinOps assessment, spending efficiency, waste identification, over-provisioned workloads, or cost attribution by namespace. Combines live Cost Explorer data, CloudWatch utilization metrics, and Kubernetes resource analysis.

EKS security and compliance assessment — 7-layer hardening stack, CIS/HIPAA/PCI/FedRAMP/SOC2/GDPR audit prep, and 30/60/90 roadmap. Covers OS/AMI selection (Bottlerocket, AL2023, RHEL, Ubuntu), identity (EKS Pod Identity vs IRSA, Access Entries vs aws-auth), workload security (Pod Security Admission, Kyverno/OPA, NetworkPolicy, Security Groups for Pods), image supply chain (ECR scanning, Cosign/Notation signing), runtime detection (GuardDuty, Falco), audit logging, etcd / secrets encryption, and compliance accelerators (Audit Manager, Config, Security Hub). Triggers on CIS Benchmark, HIPAA, PCI-DSS, FedRAMP, SOC 2, GDPR compliance, cluster hardening, audit-prep, or any regulated-workload assessment. Does not cover non-EKS platforms (ECS/ROSA), account-level security with no EKS angle, or GenAI-workload security.

Run a live EKS cluster cost efficiency assessment — analyze spending across 6 dimensions (compute efficiency, Spot/Graviton adoption, networking, storage, observability, idle resources), calculate a weighted 0-100 Cost Score, and generate a prioritized report with dollar-quantified findings and ready-to-apply remediation snippets. Use this skill when someone asks "how much am I wasting on EKS?", "run a cost audit on my cluster", "what's my biggest cost driver?", "analyze my cluster's cost efficiency", or needs dollar-denominated findings for a FinOps review — even if they don't say "cost intelligence" or "score". Combines live Cost Explorer data, CloudWatch utilization metrics, and Kubernetes resource analysis. Falls back to AWS CLI and kubectl when the EKS MCP server is unavailable. Distinct from eks-best-practices (static advisory guidance), eks-operation-review (operational health), and eks-recon (cluster discovery).

ECS environment reconnaissance and discovery. Detects compute and capacity providers, task definitions, deployment configuration, auto scaling, networking, security posture, observability, and IaC/CI-CD tooling. Use when someone asks about their ECS environment, wants to describe a cluster, inspect a service, or document task definitions — even without naming the skill. Applies to Amazon ECS, not Amazon EKS (use eks-recon). Discovers current state only — does not score, audit, or design. Skip for operational audits and GREEN/AMBER/RED scoring (ecs-operation-review), deployment-model design, launch-type selection, and ECS best practices (ecs-architect), deployment strategy design and CI/CD engineering (ecs-devops), GPU/ML workloads (ecs-genai), security and compliance (ecs-security), cost/TCO (ecs-cost-intelligence, once available), observability design (ecs-observability), and replatform/migration (ecs-modernize, once available).

Author a new steering workflow for any AWS service and pair it with a matching slash-command shim. Use when the user asks to create a steering workflow, add a workflow to apex, standardize steering, write a new workflow for EKS / RDS / Lambda / IAM / any AWS service, or build a phased playbook that plugs into a service hub. Covers the convention (frontmatter, header block, required sections), tool routing (knowledge vs. live MCP vs. setup-bridge), and the lint pass before handoff.

Use when choosing and architecting an Amazon ECS deployment model for a NEW workload — Fargate vs ECS on EC2 vs Managed Instances vs Express Mode vs ECS Anywhere/External — plus capacity-provider strategy, task sizing, awsvpc/ENI density, networking, service parameters, and launch-type or topology migration (EC2 launch type to capacity providers/Managed Instances; Service Discovery to Service Connect). Also the shared ECS best-practices corpus. Triggers include "which ECS launch type", "Fargate or EC2", "should I use Managed Instances", "migrate off EC2 launch type", "App Mesh to Service Connect", "migrate off App Runner". Skip for existing-app replatform (ecs-modernize); auditing a live estate (ecs-operation-review); cost/TCO (ecs-cost-intelligence); inventory (ecs-recon); security (ecs-security); deployment/CICD (ecs-devops); observability (ecs-observability); GPU/ML design AND GPU launch-type choice (ecs-genai); Kubernetes/EKS (eks-design); Terraform generation of a settled design (use ecs-build).

Use when building Amazon ECS infrastructure with Terraform, generating apply-ready code for ECS clusters, services, and task definitions across three capacity models — Fargate (FARGATE_SPOT as capacity provider), EC2 Auto Scaling group providers, and ECS Managed Instances. Covers rolling/blue-green/linear/canary deployment config, Express services, Service Connect, private/VPC-endpoint-only networking, secrets, and Graviton. Also use when (1) wiring a Managed Instances capacity provider and its infrastructure IAM role, (2) mixing FARGATE and FARGATE_SPOT in a strategy, (3) rendering the Terraform deployment configuration for a blue/green, linear, or canary strategy, (4) generating VPC endpoints for private or air-gapped ECS, (5) configuring Application Auto Scaling, or (6) rendering the migration of a service from launch type to capacity providers. Skip for EKS/Kubernetes builds (use eks-build), design and launch-type selection (use ecs-architect), CI/CD pipelines and release strategy (use ecs-devops).

Use when someone is deploying, releasing, or shipping software to Amazon ECS — phrased as "blue/green deployment on ECS", "canary deployment for my ECS service", "set up CI/CD for ECS", "GitHub Actions deploy to Fargate", "my ECS deployment is stuck", "ECS deployment circuit breaker", "ECS task sets", or "migrate off CodeDeploy blue/green". Covers strategy selection (rolling/blue-green/linear/canary), lifecycle hooks, circuit-breaker and alarm rollback, and pipelines (CodePipeline, GitHub Actions, ECR scanning) — scoped per launch type (EC2, Fargate, Managed Instances, ECS Anywhere). Trigger even if "deployment strategy" is never said — any release-safety, traffic-shifting, rollback, or pipeline decision for an ECS service qualifies. Skip for EKS/Kubernetes (use eks-* skills) and greenfield ECS architecture with no release angle (use ecs-architect for design and ecs-build for Terraform generation incl. deployment config blocks). For ECS monitoring stacks use ecs-observability; for GPU/ML on ECS use ecs-genai.

Deep research with structured reports and charts. ONLY use when the user explicitly requests research/analysis, or needs data visualization with charts, or quantitative/comparative analysis across multiple sources. Do NOT use for simple questions or quick lookups.

Search the web and fetch content from URLs for current information, news, and research topics.

Web browser automation for tasks requiring UI interaction, login-protected pages, or human-like browsing when APIs are insufficient.

Autonomous coding agent. Delegate any task that involves understanding, writing, or running code — from a GitHub issue, a bug report, or a user request. It explores, implements, and verifies on its own.

Create hand-drawn style diagrams and flowcharts using Excalidraw

Create, modify, and manage Excel spreadsheets.

Manage GitHub issues, PRs, branches, and repositories via OAuth (3LO). For reading issues or PR details, not for deep code analysis — delegate that to code-agent.

Read, send, draft, delete, and organize Gmail emails

妙搭（Spark/Miaoda）应用开发与托管：应用创建、本地全栈开发、云端生成迭代、创意设计（UI mockup / 可交互原型 / 线框图 / 落地页 / 仪表盘 / 幻灯片 deck / 视觉探索）、AI相关能力和飞书平台能力或者其他外部能力集成、日志/Trace/监控指标/PV/UV 查询、环境变量管理、应用角色与成员管理、自动化触发器（定时/记录变更/Webhook/飞书审批）。当用户要开发/新建一个系统·工具·平台·应用，或要本地开发 / 云端开发 / 修改 / 部署 / 发布 / 上线 / 拿可分享链接，或用 HTML 做页面·网站·部署到妙搭，或要设计 / design / mockup / prototype / wireframe / 做 PPT / deck / 视觉探索，或提到妙搭/Spark/Miaoda（应用运行时域名形如 *.aiforce.cloud）、应用数据库、应用文件存储、开放 API Key、可见范围、应用角色/角色成员、线上日志、接口请求量、错误量、延迟、访问量、环境变量、给妙搭应用配自动化任务/定时触发/审批通过后自动触发时使用。不负责普通云盘文件上传（lark-drive）、飞书文档编辑（lark-doc）、原生幻灯片创建（lark-slides）。

飞书多维表格（Base）操作：建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、workflow、角色权限；遇到 Base/多维表格/bitable 或 /base/ 链接时使用。文件导入转 lark_drive_import，认证/授权由 MCP server 自动处理。

飞书日历：管理日历日程和会议室。查看/搜索日程、创建/更新日程、管理参会人、查询忙闲和推荐时段、预定会议室。当用户需要查看日程安排、创建/修改会议、查询/预定会议室时使用。不负责：查询过去的视频会议记录（走 lark-vc）、待办任务（走 lark-task）。

飞书云文档（Docx / Wiki 文档）：读取和编辑飞书文档内容。当用户给出文档 URL 或 token，或需要查看、创建、编辑文档、插入或下载文档图片附件时使用。文档中嵌入的电子表格、多维表格、画板，先用本 skill 提取 token 再切到对应 skill。当用户给出 doubao.com 的 /docx/ 或 /wiki/ URL/token 时，也应直接使用本 skill；路由依据是 URL 路径模式和 token，而不是域名。不负责文档评论管理，也不负责表格或 Base 的数据操作。当用户明确要操作飞书思维笔记时，也使用本 skill。

飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。

飞书视频会议：搜索历史会议记录、查询会议纪要（总结/待办/章节/逐字稿）、查询参会人快照。当用户查询已结束的会议、获取会议产物（纪要/妙记）、查看参会人时使用；查询未来日程走 lark-calendar。不负责：Agent 真实入会/离会、会中实时事件（走 lark-vc-agent）。

飞书画板：查询和编辑飞书云文档中的画板。支持导出画板为预览图片、导出原始节点结构、使用多种格式更新画板内容。当用户需要查看画板内容、导出画板图片、编辑画板时使用此 skill。不负责：飞书云文档内容编辑（lark-doc）、文档内嵌电子表格/Base（lark-sheets / lark-base）。

飞书审批：查询和处理审批待办/已办/实例，搜索可发起审批定义、查看定义详情并发起原生审批实例。当用户要处理审批任务、查看审批实例、搜索或发起审批时使用。审批待办不是飞书任务；非审批类待办走 lark-task。不负责创建审批定义；三方审批定义不走原生提单。

Guide developer teams through AIDLC Inception — structured requirements gathering, design, and artifact generation

Reviews agent code for security vulnerabilities, quality issues, and agent-specific best practices. Checks for prompt injection, credential exposure, unsafe execution, error handling, and testing.

Debugging specialist for AgentCore deployments: container failures, IAM permission errors, runtime exceptions, networking issues, and performance problems. Use when developers report errors, crashes, deployment failures, or need help troubleshooting their agent applications.

Generates deployment configurations for Amazon Bedrock AgentCore. Produces Dockerfiles, IAM policies, CDK stacks, buildspec files, runtime configs, and environment variable templates following AWS security best practices and least-privilege principles.

Reviews agent applications for platform deployment readiness. Checks containerization, secrets, config, health endpoints, statefulness, error handling, dependencies, and security.

Fleet operations specialist for agent restart, scaling, graceful draining, and capacity planning. Use when teams need to restart agents, scale the fleet up or down, drain agents for maintenance, or plan capacity.

Governance specialist for agent registration, Cedar policy management, message routing configuration, and platform compliance. Use when teams need to register agents, configure policies, set up routing patterns, or enforce governance standards.

Create structured GitHub issues from review and compliance findings

Guides users to build optimal agentic AI workflows OR optimize existing agents. Analyzes use cases, recommends patterns, selects frameworks (LangGraph, CrewAI, Strands), generates production-ready code, and optimizes existing implementations based on Amazon's production lessons.

Specialized agent for optimizing existing agentic AI systems based on Amazon's production lessons and AWS best practices

Generates production-ready agentic AI implementations with AWS best practices

Specialized agent for selecting optimal agentic AI frameworks (LangGraph, CrewAI, Strands)

Specialized agent for identifying optimal agentic AI patterns based on AWS prescriptive guidance

Guides AWS development with infrastructure automation and cloud architecture patterns. Use when designing or refactoring cloud-native applications on AWS, automating environment provisioning with Terraform/CDK/CloudFormation, setting up secure CI/CD pipelines, evaluating service choices for cost/scalability/fault tolerance, or preparing production runbooks and observability.

Infrastructure as Code best practices with Terraform, Ansible, Pulumi, and CloudFormation. Use when bootstrapping cloud environments, managing remote state backends, recovering from state issues, automating CI/CD pipelines for infrastructure, modularizing infrastructure for reuse, enforcing drift detection, or performing risk assessments before applying changes.

Comprehensive AWS infrastructure management with Terraform. Covers provider configuration, state management (S3 backend with native locking in Terraform 1.11+), common resource patterns (VPC, IAM, S3, RDS, EKS), module usage, and production best practices. Use when provisioning AWS infrastructure, managing Terraform state, creating VPCs, configuring IAM roles/policies, deploying databases, or troubleshooting Terraform/AWS issues.

Run a 5-domain CAF security posture assessment for an AWS service. Produces (1) assessment-summary.md — CAF-structured findings with GAPS tables, (2) sar-facts.json — extracted SAR data, (3) checkpoint-results.json — factual checkpoint verification. These feed into the research, validate, and generate phases.

Run live AWS CLI probes against deployed compliant resources to prove each mapped control is enforced. Produces control x CLI x verdict matrix. Phase 7 of the pipeline.

Generate detective and responsive security control artifacts — Config rules with Lambda handlers, EventBridge rules, CloudWatch alarms, SSM runbooks, Step Functions workflows, CloudTrail configuration. Reads from mapping-results.json and validated.json.

Generate compliant IaC templates in all 4 formats — modular Terraform, CDK TypeScript, CloudFormation YAML, and CDK for Terraform. Uses parameter coverage matrix from mapping-results.json and API surface from validated.json.

Generate preventive and proactive security control artifacts — SCPs, resource policies, KMS key policies, permission boundaries, tag policies, OPA policies, and CloudFormation Guard rules. Reads from mapping-results.json and validated.json.

Generate all security control artifacts and compliant IaC templates from mapping-results.json and validated.json. Split into 3 focused sub-skills for better accuracy; this skill orchestrates them.

Precursor intake phase for the Service Approval pipeline. Collects service name, input type, and testing preferences. Produces intake-manifest.json consumed by all downstream phases. Supports file-based input (intake YAML) for repeatable, batch-friendly execution.

Deterministic assembly of map sub-skill outputs into final mapping-results.json, controls-catalog.md, and framework-mapping.md. Builds traceability, identifies coverage gaps, and runs comprehensive validation. No LLM reasoning required — pure data assembly.

Deploy a backend tier stack: Lambda + API Gateway v2 + DynamoDB (feature-flagged).

Compose a deployment from stack skills and generate executable artifacts (Makefiles, security disposition). Use when the user says 'compose', 'generate deployment', or invokes /ipa-compose.

Initialize IPA project configuration

Deploy a CodePipeline CI/CD pipeline with CodeBuild for automated build/test/deploy.

Deploy a Terraform state backend (S3 + DynamoDB) via CloudFormation.

Deploy a CodeCommit repository for source code management.

Deploy a Cognito User Pool stack with OAuth 2.0 Hosted UI and OIDC endpoints.

Deploy an ECR repository for container image storage.

Evaluate AI Agent Skills across safety, quality, reliability, and cost efficiency. Audit for security issues (secrets, injection, unsafe installs), test functional correctness with-skill vs without-skill, measure trigger precision, classify cost-efficiency tradeoffs, track version lifecycle, and generate unified grades. Use when evaluating a skill before installing, auditing marketplace skills, proving your skill works with automated tests, setting up CI/CD quality gates, or comparing two skill versions. NOT for: evaluating full agent systems, testing non-skill plugins, runtime performance benchmarking, or monitoring production agent behavior.

checks PR names

Validates PR titles and branch names against the company naming convention. Use when the user mentions PR titles, branch naming, pull request naming conventions, or asks to check whether a PR title or branch name follows the standard format.

Validates PR titles and branch names against the company naming convention. Use when the user mentions PR titles, branch naming, pull request naming conventions, or asks to check whether a PR title or branch name follows the standard format.

Analyze CSV and JSON data files to produce summary statistics, detect anomalies, and generate formatted reports. Use when the user asks to summarize data, compute statistics (mean, median, percentiles), find outliers, or produce tabular reports from structured data files. NOT for: image analysis, unstructured text processing, database queries, or real-time streaming data.

Gets weather

A well-structured test skill that follows the agentskills.io spec. Use when testing skill evaluation tools.

A well-structured test skill that follows the agentskills.io spec. Use when testing skill evaluation tools.