Menu
Use when AWS CLI commands fail with SSO token expiration errors like "Token has expired", "SSO session has expired", or "Error when retrieving credentials".
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Web search, content extraction, and product image discovery via real browser. Searches with Google, Bing, DuckDuckGo, or Brave (auto-fallback). Extracts page content as markdown including image URLs. Handles SPAs, anti-bot detection, and logged-in sessions. Requires one-time browser setup.
Analyze past session files to find recurring AI agent issues and fix them via AGENTS.md updates, new skills, or code/infra changes. Use when asked to improve agent workflow, find recurring problems, optimize AGENTS.md, create skills from session patterns, or understand what went wrong across sessions.
Use tmux instead of bash tool to run commands that take more than ~30 seconds, like bulk operations, db migrations, dev servers.
Gather recent Slack messages, read threads, and send replies. Use when the user asks about Slack activity or wants to interact with Slack.
Manage Linear issues: Create issues, update issues, search issues. Best when combined with GitHub CLI
| name | aws-sso |
| description | Use when AWS CLI commands fail with SSO token expiration errors like "Token has expired", "SSO session has expired", or "Error when retrieving credentials". |
This skill handles AWS SSO token expiration. Use it when AWS commands fail with authentication errors.
Trigger this skill when you see errors like:
Token has expired and refresh failedThe SSO session has expiredError when retrieving credentialsThe SSO access token has expiredRun the login command in a tmux session with --no-browser to capture the URL:
tmux new-session -d -s aws-sso 'aws sso login --profile <profile-name> --no-browser > /tmp/pi-tmux-aws-sso.log 2>&1'
sleep 1
cat /tmp/pi-tmux-aws-sso.log
The output will contain:
Browser will not be automatically opened.
Please visit the following URL:
https://oidc.<region>.amazonaws.com/authorize?...
Show the user the URL and ask them to complete authentication:
⚠️ AWS SSO token expired for profile `<profile-name>`.
Please open this URL in your browser to authenticate:
<url>
Let me know when you've completed the login.
After user confirms, check if login succeeded:
cat /tmp/pi-tmux-aws-sso.log
Look for Successfully logged into Start URL: in the output.
Then verify credentials work:
aws sts get-caller-identity --profile <profile-name>
tmux kill-session -t aws-sso 2>/dev/null
rm -f /tmp/pi-tmux-aws-sso.log
grep '^\[profile' ~/.aws/config | sed 's/\[profile \(.*\)\]/\1/'
aws sts get-caller-identity --profile <profile-name> 2>&1
--no-browser - lets us capture and show the URL