Menu
Use when the user asks about read-only AWS inventory — Lambda functions, RDS databases, S3 buckets, or CloudWatch metrics in an AWS account. Queries are scoped to a single region (except list_buckets, which is account-wide). Never modifies AWS resources.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when the user asks about Confluence content or wants to create, update, or delete Confluence pages and comments — CQL search, page retrieval, space metadata, comments, attachments, or any write operation on pages. Supports both read and write surfaces; every action passes the policy gate before any network call is made: read actions succeed by default, write and delete actions escalate by default, privilege actions are hard-denied.
Use when the user asks about Jira data or wants to create, update, or delete Jira content — JQL search, issue details, project metadata, comments, attachments, status transitions, or any write operation on issues and comments. Supports both read and write surfaces; every action passes the policy gate before any network call is made: read actions succeed by default, write and delete actions escalate by default, privilege actions are hard-denied.
Use when the user asks about read-only GCP inventory — Cloud Run services, Cloud SQL instances, Pub/Sub topics, or Cloud Logging entries. Queries are scoped to a single GCP project. Never modifies GCP resources.
Use when the user asks about GitLab data or wants to act on GitLab — project info, code search, issue/MR/release/pipeline inspection, or any write that creates, updates, closes, or deletes an MR, issue, note, or release; merging MRs (admin); and managing CI pipeline runs (retry / cancel / trigger / play_job).
Use this skill whenever the user wants to add a new agent connector to their @narai connectors workspace — wrapping a SaaS API, REST endpoint, GraphQL endpoint, SDK, or CLI tool into the canonical @narai connector shape (CLI + library + Claude Code plugin). Trigger even if the user doesn't say "connector" explicitly: phrases like "I want to query Stripe from Claude", "add Slack to our agents", "wrap our internal orders API", "connect Salesforce", "I have a GraphQL endpoint we need exposed", "make a Linear agent" all warrant this skill. Walks the user through identity, auth, and action-surface questions, then scaffolds the package, plugin layer, and tests by stamping out canonical templates and generating per-connector code. Do NOT use for: modifying existing connectors (just edit the file), wrapping MCP servers (different abstraction), or querying databases (db-agent-connector already covers postgres/mysql/sqlite/mssql/mongodb/dynamodb/oracle).
Use this skill when the user wants to add a custom connector to their project — wrapping a SaaS API, REST endpoint, GraphQL endpoint, SDK, or CLI tool so Claude can call it via `gather()` from `narai-primitives`. Trigger even when the user doesn't say "connector" explicitly: phrases like "I want to query Stripe from Claude", "add Slack to our agents", "wrap our internal orders API", "connect Salesforce", "make a Linear agent" all warrant this skill. Also triggers for: "gate kubectl in prod", "approve before force push", "pull from Linear, summarize, post to Slack", "document this workflow". Scaffolds a minimal local connector at `.connectors/connectors/<name>/` (project scope, default) or `~/.connectors/connectors/<name>/` (user scope) — no `git init`, no `npm publish`, no plugin manifest, no marketplace entry. Do NOT use for: modifying an existing connector (just edit the file), wrapping an MCP server (different abstraction), querying databases (the `db` connector inside narai-primitives already covers postg
| name | aws-connector |
| description | Use when the user asks about read-only AWS inventory — Lambda functions, RDS databases, S3 buckets, or CloudWatch metrics in an AWS account. Queries are scoped to a single region (except list_buckets, which is account-wide). Never modifies AWS resources. |
| context | fork |
Answer the user's question by invoking the aws-connector binary exposed by
this plugin. It delegates to narai-primitives/aws, which speaks to
AWS via the read-only SDK v3 surface.
aws-connector --action <action> --params '<json>'
The CLI writes a single JSON envelope to stdout and exits 0 on success, 1 on a handled error, 2 on CLI misuse. Return the envelope verbatim to the orchestrator — do not paraphrase or re-format.
| Action | Required params | Notes |
|---|---|---|
list_functions | region, optional prefix | Returns Lambda functions in the region, optionally filtered by name prefix |
describe_db | region, db_identifier | Returns an RDS instance's engine, version, endpoint, storage, and status |
list_buckets | optional prefix, optional region | Returns S3 buckets across the account |
get_metrics | region, namespace, metric_name, dimensions, optional hours (default 24, max 168) | CloudWatch datapoints at 5-min resolution |
Example:
aws-connector --action list_functions --params '{"region":"us-east-1","prefix":"acme-"}'
Success:
{"status": "success", "action": "<name>", "data": { ... }}
Error (handled):
{"status": "error", "action": "<name>", "error_code": "<CODE>", "message": "...", "retriable": true}
Known error codes: VALIDATION_ERROR, AUTH_ERROR, NOT_FOUND,
RATE_LIMITED, TIMEOUT, CONNECTION_ERROR, CONFIG_ERROR,
CONFIGURATION_ERROR.
The connector uses the default AWS credential chain — profiles,
environment variables, instance/container/EKS roles — whichever is
configured on the host. If both AWS_ACCESS_KEY_ID and
AWS_SECRET_ACCESS_KEY are set via @narai/credential-providers, those
take precedence.
Read-only by construction: only Describe*, List*, and Get* SDK
commands are whitelisted inside the connector. Write/modify operations
cannot be invoked through this skill.