remediating-with-aws-security-agent

Pull AWS Security Agent findings (penetration tests and code reviews) and drive remediation. Use this whenever the user mentions Security Agent, security findings, pentest or penetration test results, code review findings, vulnerabilities found in their AWS account, "what did the security scan find", remediating or triaging security risks, or wants to start fixing reported vulnerabilities — even if they don't name the service explicitly. Trigger it for phrases like "get my security findings", "what vulnerabilities do we have", "let's fix the pentest results", or "triage the security report". The skill discovers scans, exports findings to a gitignored local directory (so sensitive exploit detail is never committed), produces a prioritized triage summary, and offers to start fixing the highest-risk issues.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a well-sequenced, validated workflow, but it is a long single-file document that repeats guardrail rationale and keeps reference-grade detail inline rather than splitting it into separate files.

Suggestions

Move the detailed API command reference and/or the full triage ranking rules into a separate reference file (e.g. references/triage-rules.md) and link to it from SKILL.md, keeping the overview concise.

Tighten the repeated gitignore/guardrail messaging into one stated rule plus brief callouts, and trim the rationale prose in 'Why the ordering and the guardrails matter' to the essential non-negotiable.

Add a brief validation step in Stage 4 (e.g. confirm the fix addresses the finding or re-check the affected location) so remediation has the same feedback loop rigor as the export stage.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and product-specific (real CLI commands, enum values, sort keys) but carries explanatory prose and repetition — e.g. the 'Why the ordering and the guardrails matter' rationale and the gitignore rule restated across multiple sections — that could be tightened without losing clarity.	2 / 3
Actionability	Provides fully executable AWS CLI commands with real flags ('aws securityagent list-findings --agent-space-id ... --pentest-job-id ...'), concrete batch sizing (25), exact confidence/risk enums, and a copy-paste summary template.	3 / 3
Workflow Clarity	Four stages are clearly sequenced with explicit validation checkpoints — gitignore-before-write as step 1, COMPLETED-only job filtering, confirm-before-export, and edge-case recovery ('offer to re-check later', 'aws sts get-caller-identity' for credential issues) — so batch operations are not left unvalidated.	3 / 3
Progressive Disclosure	Well-organized into clear staged sections, but it is a single ~245-line monolithic SKILL.md with no external reference files; the detailed command listing and triage ranking rules are inline material that could be split into a one-level-deep reference.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinctive, with a strong set of natural trigger phrases and explicit what/when guidance written in third person. It is a strong, low-conflict description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Pull AWS Security Agent findings', 'discovers scans, exports findings to a gitignored local directory', 'produces a prioritized triage summary', and 'offers to start fixing the highest-risk issues' — going well beyond naming a domain.	3 / 3
Completeness	Explicitly answers both what ('discovers scans, exports findings... produces a prioritized triage summary, and offers to start fixing') and when ('Use this whenever the user mentions... Trigger it for phrases like...') with explicit trigger guidance.	3 / 3
Trigger Term Quality	Strong coverage of natural phrasings users would actually say, including 'what did the security scan find', 'get my security findings', 'what vulnerabilities do we have', 'let's fix the pentest results', and 'triage the security report'.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (AWS Security Agent findings remediation) with distinct, service-specific triggers, making it unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-agents-for-devsecops/skills/remediating-with-aws-security-agent/SKILL.md
Commit: 222ce56

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.