pentesting-with-aws-security-agent

Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain, exercises the supplied endpoints with the managed Security Agent service, and returns verified runtime findings. Use when the user asks to pentest, run a penetration test, test their app's attack surface, find runtime vulnerabilities, register or verify a target domain, or check pentest status / findings.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced workflow skill built around executable AWS CLI commands with explicit validation checkpoints and error-recovery guidance. It is token-efficient and cleanly structured, with only minor redundancy between the inline steps and the Rules section.

Dimension	Reasoning	Score
Conciseness	Lean and CLI-driven, assuming Claude's competence with no padded concept explanations; the standalone "Rules" section restates a few facts already stated inline (authorization, 15-minute polling, hyphenated titles), which could be trimmed.	4 / 5
Actionability	Fully executable copy-paste AWS CLI commands with a placeholder-resolution table, a concrete pentests.json record shape, and an explicit findings-report format covering the common cases.	5 / 5
Workflow Clarity	Clearly numbered 1–6 sequence with explicit validation (pre-pentest agent-space and authorization checks, domain verification), terminal-state checkpoints in the polling loop, and troubleshooting feedback loops for error recovery.	5 / 5
Progressive Disclosure	Well-organized into clearly headed sections with no nested or buried references; no bundle files exist so all content lives in one file, which is appropriate for a CLI workflow skill but offers no progressive disclosure to sub-files.	4 / 5
	Total	18 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with explicit "Use when" triggers and comprehensive natural-language synonyms. Concrete actions are named rather than described abstractly, and the AWS Security Agent framing keeps it largely distinct from adjacent skills.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — "registers and verifies the target domain", "exercises the supplied endpoints", "returns verified runtime findings" — with only minor coverage gaps (no mention of polling or stopping a pentest).	4 / 5
Completeness	Explicitly answers both what (run an AWS Security Agent pentest: register/verify domain, exercise endpoints, return findings) and when via a concrete "Use when..." clause with multiple trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural trigger coverage including synonyms — "pentest", "run a penetration test", "test their app's attack surface", "find runtime vulnerabilities", "register or verify a target domain", "check pentest status / findings" — matching how a user would actually phrase the request.	5 / 5
Distinctiveness Conflict Risk	Clear AWS Security Agent / live-web-app niche with distinct pentest triggers; minor overlap risk from the broad phrase "test their app's attack surface" and proximity to the sibling setup-security-agent skill.	4 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-agents-for-devsecops/skills/pentesting-with-aws-security-agent/SKILL.md
Commit: d6ad2e4

Reviewed: 20 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.