remediating-with-aws-security-agent

Pull AWS Security Agent findings (penetration tests and code reviews) and drive remediation. Use this whenever the user mentions Security Agent, security findings, pentest or penetration test results, code review findings, vulnerabilities found in their AWS account, "what did the security scan find", remediating or triaging security risks, or wants to start fixing reported vulnerabilities — even if they don't name the service explicitly. Trigger it for phrases like "get my security findings", "what vulnerabilities do we have", "let's fix the pentest results", or "triage the security report". The skill discovers scans, exports findings to a gitignored local directory (so sensitive exploit detail is never committed), produces a prioritized triage summary, and offers to start fixing the highest-risk issues.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced workflow skill with strong validation checkpoints for its batch export of sensitive findings. Its main gap is progressive disclosure: everything lives in one long SKILL.md with no file-level references despite length that would benefit from splitting.

Suggestions

Move the triage ranking rules (risk-level/score/confidence ordering) and the summary-format template into a reference file (e.g. references/triage.md) and link to it from Stage 3, keeping only the decision logic inline.

Tighten the 'Why the ordering and guardrails matter' section to the single non-negotiable rule and the one-sentence rationale, trimming the rest of the explanatory prose.

Consider extracting the Stage 2 export sub-steps (directory lockdown, latest-job resolution, batch fetching) into a checklist-style reference so the SKILL.md body stays a concise stage overview.

Dimension	Reasoning	Score
Conciseness	Dense and operational, assuming Claude's competence without explaining what a pentest is, but the 'Why the ordering and guardrails matter' and 'Match the codebase to a scan' sections contain explanatory prose that could be trimmed slightly.	4 / 5
Actionability	Provides copy-paste-ready AWS CLI commands with exact parameter syntax, pagination via --next-token, batch-25 chunking for batch-get-findings, and concrete file-naming and sorting rules covering the common cases.	5 / 5
Workflow Clarity	Four clearly sequenced stages with explicit validation checkpoints — gitignore before any write, user confirmation before export, COMPLETED-only job filtering, and confidence filtering — plus feedback loops for edge cases like no-completed-jobs and credential failures.	5 / 5
Progressive Disclosure	Well-organized into staged sections but entirely monolithic at 245 lines with no bundle files or external references; the triage ranking rules and summary-format template could be split into a reference file to aid navigation.	3 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states capabilities, provides rich natural trigger terms and phrases, and explicitly covers both what the skill does and when to invoke it. It is well-distinguished from adjacent skills by tying triggers to the named AWS service.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'discovers scans, exports findings to a gitignored local directory, produces a prioritized triage summary, and offers to start fixing the highest-risk issues' — giving comprehensive coverage of what the skill does.	5 / 5
Completeness	Explicitly answers both 'what' (discover/export/triage/remediate) and 'when' via a clear 'Use this whenever...' clause with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Comprehensive natural-term coverage including synonyms ('pentest or penetration test results', 'security findings', 'vulnerabilities') and realistic user phrases like 'get my security findings', 'what vulnerabilities do we have', and 'triage the security report'.	5 / 5
Distinctiveness Conflict Risk	Anchored to the specific AWS Security Agent service and pentest/code-review finding context, with distinct triggers that minimize overlap with generic security or code-review skills.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-agents-for-devsecops/skills/remediating-with-aws-security-agent/SKILL.md
Commit: 8ea26bd

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.