aws-secrets-manager

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: access-control, api, cloud, secrets, security.

What it does

Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords. Prevents AI agents from directly fetching secret values and teaches runtime dynamic references with asm-exec so plaintext never enters the LLM context window.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-secrets-manager

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/aws-secrets-manager ~/.claude/skills/aws-secrets-manager

Safety box score

Grade C, moderate risk: 39 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is about resolving AWS Secrets Manager values at runtime via `asm-exec`, using either a local SMA daemon or a signed call to an AWS MCP endpoint so plaintext secrets stay out of the agent context. The main risks are broad access to secrets and AWS credentials, outbound network calls to AWS, and the ability to run shell commands and write generated files while handling those secrets.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The skill explicitly says `asm-exec` `exec`s the target command and describes resolution followed by `subprocess.run`, with examples like `sh -c`.
Network access	2 (moderate)	Secret resolution can call the local SMA on `localhost:2773` or the remote MCP endpoint `https://aws-mcp.us-east-1.api.aws/mcp`, sending SigV4-signed requests off-box.
Filesystem reach	1 (low)	It shows secrets being written to a file outside the workspace, e.g. `echo "password=..." > /tmp/app.conf`, which can leave plaintext on disk briefly.
Secrets & credentials	3 (high)	The whole purpose is handling credentials, API keys, tokens, and passwords, and it may also source AWS signing credentials from environment variables and `aws configure export-credentials` / `aws configure get`.
Privilege & persistence	1 (low)	It does not require sudo or system service changes, but it does depend on AWS credentials and `secretsmanager:GetSecretValue` access.
Instruction hijack surface	0 (none)	The file contains security guidance and no hidden instructions, prompt injection, or attempts to bypass confirmations.
Irreversible actions	0 (none)	It does not itself push, post, pay, book, or delete; it only resolves secrets for commands the user runs.
Transparency	0 (none)	The provided material is plain markdown; no binaries, minified blobs, or decoded-at-runtime code are visible.

Before installing

Read any shipped `asm-exec` or hook code and verify it never logs resolved plaintext or shells out unexpectedly.
Test in a throwaway AWS profile with only one non-production secret and confirm the IAM policy is narrowly scoped.
Check the referenced `plugins/aws-core/com.anthropic.claude-code/hooks/hooks.json` to confirm the block on `get-secret-value` really applies everywhere.
Verify whether your workflow ever writes resolved secrets to files like `/tmp/app.conf` and avoid that path if possible.

Rated 2026-10-14 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-core/skills/aws-secrets-manager/SKILL.md
Branch: main
Collection: aws-core
Updated: 2026-09-19

aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
aws-iam — Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits.
agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
django-storages-s3 — Use when configuring Django to store static and media files on AWS S3 with django-storages.
amazon-bedrock — Builds generative AI applications on Amazon Bedrock.
aws-cloudformation — Authors, validates, and troubleshoots AWS CloudFormation templates.