CtrlK
BlogDocsLog inGet started
Tessl Logo

aws-auth

Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries. Covers sign-up/sign-in flows and the login page (Cognito-hosted UI / managed login), MFA, password policies, OAuth 2.0 / OIDC flows (auth-code + PKCE, client credentials), social/SAML federation, tokens (ID/access/refresh, rotation, revocation, storage), Cognito Lambda triggers, identity pools (temp AWS creds), and gating API Gateway (or ALB) routes to signed-in users via Cognito/JWT authorizers. Applies when adding a login or sign-up page, configuring a user pool or app client, choosing user pool vs identity pool, wiring social/SAML, refreshing tokens, requiring sign-in on an API Gateway or ALB, or debugging redirect_uri/token/MFA/CORS/federation errors. Does NOT cover Amplify Gen2 backend definitions (defineAuth, npx ampx → aws-amplify), IAM/STS/Identity Center (→ aws-iam), or API Gateway/Lambda resource config beyond the authorizer (→ aws-serverless).

72

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is aws-auth in aws/agent-toolkit-for-aws

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-architected overview skill that uses progressive disclosure effectively: a high-signal body of critical warnings, navigation tables, and troubleshooting pointers delegating depth to nine real reference files. The main weakness is mild redundancy of the out-of-scope exclusions between frontmatter and body, and the absence of in-body executable code blocks.

Suggestions

Remove or condense the duplicate out-of-scope material: the body's 'When NOT to use' and 'Not Covered By This Skill' sections repeat the frontmatter's 'Does NOT cover' clause — keep it in one place to recover tokens.

Add at least one small end-to-end executable snippet inline (e.g. a minimal Amplify `signIn`/`fetchAuthSession` or a `aws cognito-idp create-user-pool` call) so the body is copy-paste actionable without always opening a reference.

For the most common workflow ('add sign-up and login to a React app'), add a short numbered sequence with an explicit validation checkpoint (e.g. '4. Confirm hosted UI callback returns a code; if redirect_mismatch, fix the callback URL') to lift workflow clarity toward a feedback-loop structure.

DimensionReasoningScore

Conciseness

Mostly lean and high-signal with concrete warnings and navigation tables, but the 'When NOT to use' and 'Not Covered By This Skill' sections restate exclusions already in the frontmatter 'Does NOT cover' clause — minor redundancy that could be trimmed. Not a 5 because those repeated exclusions are tokens that don't earn their place a second time.

4 / 5

Actionability

Provides concrete commands and parameters throughout — 'update-user-pool-client ... describe-user-pool-client first', 'response_type=code + code_challenge', JWT fields 'iss, aud/client_id, token_use, exp', 'aws-jwt-verify' — but the body is a navigation hub that delegates full copy-paste code to the references, leaving minor gaps. Not a 5 because there are no complete executable code blocks in the body itself.

4 / 5

Workflow Clarity

Destructive FULL-REPLACE operations get an explicit read-modify-write validation pattern ('describe-user-pool-client first, then re-send every existing field plus your change'), avoiding the destructive-cap-at-3 penalty, and 'Common Workflows' route requests to references. Not a 5 because the main workflows are routed rather than presented as numbered sequences with validate→fix→retry feedback loops in the body.

4 / 5

Progressive Disclosure

A clear overview body with a 'Quick Navigation' table mapping tasks to one-level-deep reference files (all verified to exist: user-pools, managed-login-oauth, tokens-and-sessions, identity-pools, api-authorization, lambda-triggers, passkeys, threat-protection, troubleshooting), with well-signaled links and no nested reference chains.

5 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: third-person voice, comprehensive concrete capabilities, explicit 'Applies when' triggers, and clear boundary statements excluding adjacent skills. Every dimension lands at the top anchor with no fluff or over-claims.

DimensionReasoningScore

Specificity

Lists many concrete capabilities — 'sign-up/sign-in flows', 'MFA, password policies', 'OAuth 2.0 / OIDC flows (auth-code + PKCE, client credentials)', 'tokens (ID/access/refresh, rotation, revocation, storage)', 'Cognito Lambda triggers', 'gating API Gateway (or ALB) routes' — giving comprehensive coverage rather than vague abstraction.

5 / 5

Completeness

Explicitly answers both 'what' ('Adds user authentication... Covers...') and 'when' ('Applies when adding a login or sign-up page...'), plus explicit out-of-scope boundaries, matching the anchor that requires concrete trigger phrases for both.

5 / 5

Trigger Term Quality

Includes natural phrases users actually say — 'adding a login or sign-up page', 'configuring a user pool or app client', 'refreshing tokens', 'debugging redirect_uri/token/MFA/CORS/federation errors' — covering synonyms and concrete error terms.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear Cognito/Amplify-client-auth niche with distinct triggers and explicit 'Does NOT cover' routing to aws-iam and aws-serverless, minimizing conflict with adjacent skills.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
aws/agent-toolkit-for-aws
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.