amazon-neptune

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analysis, aws, database, graph, migration.

What it does

Provides authoritative guidance on Amazon Neptune Database and Neptune Analytics for graph, knowledge-graph, and relationship-heavy workloads — fraud detection / fraud rings, agentic memory / chatbot context across sessions, recommendations, identity resolution, Gremlin / openCypher / SPARQL queries, supernode / slow traversal, Neo4j to Neptune migration / APOC compatibility, Neptune Database vs Analytics engine selection, PageRank / community detection, GraphRAG, and connectivity from Lambda / EC2 / applications. Creates and modifies Neptune Database clusters/instances and Neptune Analytics graphs on explicit user confirmation; blocks destructive operations (delete, reset-graph, failover, major upgrade) and redirects to change-control.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill amazon-neptune

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/amazon-neptune ~/.claude/skills/amazon-neptune

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is for Amazon Neptune administration, graph querying, migration, and GraphRAG/agent-memory workflows. The main risks are that it can provision and modify real AWS Neptune resources, and the shipped helper scripts can either wipe graph data or build throwaway infrastructure if run with the documented flags.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The repo ships runnable Python helpers (`scripts/*.py`) and CDK instructions (`cdk deploy`, `pip install ...`) that execute code and AWS API calls, though it does not eval arbitrary fetched code.
Network access	2 (moderate)	It talks to AWS services via `boto3`/AWS CLI and downloads a Gremlin console archive with `curl`/`wget` in `references/connectivity.md`.
Filesystem reach	1 (low)	Local file effects appear limited to working-directory artifacts such as the downloaded/unzipped Gremlin console and generated outputs; there is no evidence of system-wide file editing or recursive local deletion.
Secrets & credentials	1 (low)	The skill depends on IAM-authenticated AWS access and `boto3.Session().get_credentials()`, but it does not ask for passwords or read credential stores.
Privilege & persistence	2 (moderate)	It includes an explicit privileged install command (`sudo yum install -y java-11-amazon-corretto`) and infrastructure-changing CDK/AWS deployment steps.
Instruction hijack surface	0 (none)	I found no prompt-injection content that tells the agent to ignore rules, hide actions, or follow remote instructions.
Irreversible actions	2 (moderate)	It can create/modify Neptune clusters, graphs, snapshots, alarms, and seed data, but destructive actions are generally refused or gated by confirmation.
Transparency	1 (low)	All shipped scripts and markdown are readable; the main opacity is a remote archive download for Gremlin Console rather than embedded binaries or decoded-at-runtime code.

Before installing

Read `scripts/seed_test_data.py` and decide whether `g.V().drop()` is acceptable in your environment.
If you will use the Gremlin Console path, verify the downloaded archive hash or use a locally curated package instead of blind `curl`/`wget`.
Use a disposable AWS account or dedicated test cluster first: `scripts/cdk_test_env.py` creates and later destroys real infrastructure.
Keep public endpoints off unless you explicitly need them; if enabled, review IAM auth and security-group scope first.

Rated 2026-10-14 by an automated review of 22 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/database-skills/amazon-neptune/SKILL.md
Branch: main
Updated: 2026-09-19

aurora-dsql — Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans.
dms-schema-conversion — Handles the full DMS Schema Conversion lifecycle including creating migration projects, converting database schemas to a target engine.
migrate-to-msk — Helps migrate self-managed Apache Kafka workloads to Amazon MSK Express.
migrating-to-amazon-redshift — Guides an end-to-end data-warehouse migration to Amazon Redshift — discovery, schema/SQL/stored-procedure/macro/script conversion, data migration, validation.
aws-database — Routes any task involving AWS databases — choosing, comparing, recommending, getting started with.
creating-data-lake-table — Create managed Iceberg tables using Amazon S3 Tables (s3tables API namespace) with automatic compaction and snapshot management.