agents-harden

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: access-control, architecture, cloud, security, validation.

What it does

Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: "production checklist", "harden agent", "production ready", "secure agent", "inbound auth", "going live", "cold start optimization", "session lifecycle", "StopRuntimeSession", "quota", "throttling", "maxVms", "rate limit", "security audit of outbound API calls", "gateway target audit for production", "restrict who can call", "lock down endpoint", "only our app can call". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill agents-harden

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents/skills/agents-harden ~/.claude/skills/agents-harden

Safety box score

Grade C, moderate risk: 32 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill audits and adjusts AgentCore production settings by running shell/AWS CLI checks, reading `agentcore/agentcore.json`, and sometimes creating or updating AWS resources like EventBridge rules and CloudWatch log retention. The main risks are live cloud-side changes in your AWS account and inspection of local dev secret files; it does not contain binaries or require elevated OS privileges.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It runs scoped shell/AWS CLI commands such as `agentcore --version`, `agentcore status`, `aws iam list-policies`, `grep`, and `jq`, but does not execute downloaded code or `eval`.
Network access	2 (moderate)	It talks to AWS control-plane APIs and may query remote docs/MCP sources, e.g. `aws events put-rule`, `aws logs put-retention-policy`, and `Use the awsknowledge MCP server if available`.
Filesystem reach	1 (low)	It reads `agentcore/agentcore.json` and tells you to edit that file, plus it inspects `agentcore/.env.local`, but stays within the project/local-dev scope.
Secrets & credentials	1 (low)	It explicitly scans for secret-like values and notes that `agentcore/.env.local` is read by `agentcore dev`, so local credentials may be exposed to the agent during review.
Privilege & persistence	0 (none)	No sudo, service installation, shell startup edits, or other OS-level privilege changes are requested.
Instruction hijack surface	1 (low)	It pulls in remote knowledge via `awsknowledge`/external docs and uses generated guidance, but it does not tell the agent to ignore its rules or skip confirmation.
Irreversible actions	2 (moderate)	It can prompt live changes such as `agentcore deploy -y`, `aws events put-rule`, and `aws logs put-retention-policy`, which alter production behavior without further human interaction once run.
Transparency	0 (none)	The skill files are plain readable markdown; there are no binaries, minified blobs, or decoded-at-runtime code.

Before installing

Run it first in a sandbox AWS account; it will query IAM, quotas, and runtime status.
Check whether you are comfortable with `agentcore deploy -y` and EventBridge/log-retention changes being applied to your account.
Review or clear `agentcore/.env.local` before use if you keep local credentials there.
Make sure the project’s `agentcore/agentcore.json` is the one you want the agent to edit.

Rated 2026-10-15 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-agents/skills/agents-harden/SKILL.md
Branch: main
Collection: aws-agents
Updated: 2026-09-19

aws-iam — Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits.
agents-pay — Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments.
aws-cloudformation — Authors, validates, and troubleshoots AWS CloudFormation templates.
aws-database — Routes any task involving AWS databases — choosing, comparing, recommending, getting started with.
aws-networking — Routes AWS networking requests to the correct service skill for implementation.
aws-secrets-manager — Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords.