aws-step-functions
An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: automation, aws, orchestration, serverless, workflow.
What it does
Authors and edits AWS Step Functions state machines: writes Amazon States Language (ASL) in JSONata, and chooses and structures state types (Task, Choice, Map, Parallel, Pass, Wait, Succeed, Fail). Covers ASL syntax, JSONata data transformation and variables, Retry/Catch error handling, service integrations (.sync, waitForTaskToken callbacks), Distributed Map for large-scale S3/CSV processing, saga/compensation patterns, Standard vs Express workflow choice, TestState API unit testing, and migrating state machines from JSONPath to JSONata. Use when the user is building, authoring, debugging, or migrating a Step Functions state machine or ASL definition, or orchestrating multi-step workflows with branching, retries, or human-approval callbacks, even if they don't say 'Step Functions.' Do NOT use for general Lambda function code, API Gateway, EventBridge wiring, or SAM/CDK application packaging.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add aws/agent-toolkit-for-aws --skill aws-step-functionsOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/serverless-skills/aws-step-functions ~/.claude/skills/aws-step-functionsSafety box score
Grade B, low risk: 19 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is plain-text guidance plus ASL example files for AWS Step Functions; it does not ship runnable code, installers, or local scripts. The main blast radius is on AWS: copied workflows can send SQS/SNS messages, start child executions, and handle approval callbacks, and the examples include sensitive task-token handling.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No native scripts or code execution are shipped; the repository is markdown plus `.asl.json` examples only. |
| Network access | 1 (low) | Network use is limited to documented AWS API/CLI calls such as `aws stepfunctions test-state` and service integrations like `sqs:sendMessage` and `sns:publish`, and the docs say to ask before making AWS API calls. |
| Filesystem reach | 1 (low) | The skill targets state-machine definition files saved as `.asl.json` in the project workspace; it does not touch dotfiles, system paths, or other outside-project locations. |
| Secrets & credentials | 1 (low) | It explicitly treats `.waitForTaskToken` tokens as credentials and discusses AWS credentials/Secrets Manager, but it does not request pasted passwords or read local secret stores. |
| Privilege & persistence | 0 (none) | There is no sudo, service installation, shell-profile editing, or other local privilege change in the shipped files. |
| Instruction hijack surface | 0 (none) | No file tells the agent to ignore instructions, hide behavior, or follow remote content; the text is straightforward Step Functions guidance. |
| Irreversible actions | 2 (moderate) | The examples can send messages, publish notifications, and start executions (`sqs:sendMessage`, `sns:publish`, `states:startExecution`), which are real AWS-side actions even though they are template definitions. |
| Transparency | 0 (none) | All reviewed files are readable text; there are no binaries, base64 blobs, or downloaded installers. |
Before installing
- Read `assets/human-in-the-loop-with-timeout-escalation.asl.json` if you do not want task tokens placed in SQS payloads.
- Run `aws stepfunctions test-state` only in a scratch AWS account first, and avoid `--reveal-secrets` unless you need HTTP trace data.
- Check whether you are comfortable with examples that send SQS/SNS messages and start child executions before copying them into production.
Rated 2026-10-19 by an automated review of 16 files from the skill's repository.
Source
- Repository
- aws/agent-toolkit-for-aws (all skills from this repository)
- Path
- skills/specialized-skills/serverless-skills/aws-step-functions/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- aws-lambda-durable-functions — Builds resilient, long-running, multi-step applications with AWS Lambda durable functions with automatic state persistence, retry logic.
- processing-s3-uploads-with-step-functions — Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size.
- aws-serverless — Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.
- automate-me — Use for "automate me", "create/update/refresh my -mode skill", "turn/capture my preferences or working style into a skill".
- cancel-ralph — Cancel an active Ralph Loop. Use when the user wants to stop, cancel, or abort a running ralph loop.
- churn-prevention — When the user wants to reduce churn, build cancellation flows, set up save offers, recover failed payments, or implement retention strategies.