Skills Explorer Add Skills

aws-cdk

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: cloud, devops, infrastructure, python, typescript.

What it does

Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Applies when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or CloudFormation errors, planning stack structure, importing existing resources, resolving drift, or refactoring stacks without resource replacement.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-cdk

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/aws-cdk ~/.claude/skills/aws-cdk

Safety box score

Grade D, elevated risk: 53 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a high-impact AWS CDK operator: it runs synth/deploy/destroy/import/refactor workflows, installs packages, and can bootstrap accounts with elevated AWS permissions. The main risks are irreversible cloud changes, account-level privilege requirements, and commands that touch local build state and AWS credentials.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It directs the agent to run shell/package commands such as `npx cdk synth`, `npx tsx bin/$APP_NAME.ts`, `pip install -r requirements.txt`, and `rm -rf cdk.out`, so it executes code in the project and toolchain.
Network access2 (moderate)It contacts AWS APIs and package registries via commands like `cdk bootstrap aws://$ACCOUNT/$REGION`, `aws sts get-caller-identity`, `aws cloudformation describe-events`, and `npm install cdk-nag`.
Filesystem reach2 (moderate)It reads/writes project and home paths and recommends destructive local cleanup such as `rm -rf cdk.out dist` and `rm -rf node_modules && npm ci && npm dedupe`, plus `~/.aws/credentials` and `~/.cdk.json`.
Secrets & credentials2 (moderate)It explicitly uses AWS credential sources and login flows, including `~/.aws/credentials`, `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`, `aws sso login --profile $PROFILE`, and `sts:AssumeRole` troubleshooting.
Privilege & persistence2 (moderate)Bootstrap requires elevated AWS rights — the skill says `Bootstrap REQUIRES near-administrator permissions` and uses `--trust` and `--cloudformation-execution-policies` to create and govern IAM roles.
Instruction hijack surface0 (none)No hidden prompts, remote instruction fetching, or instructions to ignore safeguards were found; the markdown is operational guidance only.
Irreversible actions3 (high)Its purpose is to deploy, destroy, import, refactor, and roll back live AWS infrastructure, including irreversible or partially irreversible actions like `cdk destroy`, `cdk import`, and `cdk deploy --express`.
Transparency0 (none)All shipped files are readable markdown; there are no binaries, embedded blobs, or decoded-at-runtime scripts in the skill bundle.

Before installing

Rated 2026-10-20 by an automated review of 11 files from the skill's repository.

Source

Repository
aws/agent-toolkit-for-aws (all skills from this repository)
Path
plugins/aws-core/skills/aws-cdk/SKILL.md
Branch
main
Collection
aws-core
Updated
2026-09-19