aws-transform

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, cli, code-quality, migration, performance.

What it does

Performs code upgrades, migrations, and transformations using the AWS Transform (ATX) CLI. Use when upgrading language versions, migrating AWS SDKs, migrating frameworks (Angular, Vue.js, Spring Boot, React), upgrading libraries, optimizing performance, migrating x86 to Graviton, analyzing codebases / generating documentation, or defining custom transformations with natural language. Runs locally on a few repositories or at scale across hundreds via AWS Batch/Fargate.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-transform

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/migration-and-modernization-skills/aws-transform ~/.claude/skills/aws-transform

Safety box score

Grade F, high risk: 91 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill can install tooling, read AWS credentials, create Secrets Manager secrets, attach IAM policies, and deploy AWS Batch/Lambda infrastructure to transform code locally or in the cloud. The main risks are broad AWS-account access, network-delivered installers and runtime-fetched infrastructure, and persistent writes under `~/.aws/atx` plus transformed repos.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It explicitly runs shell commands and background scripts, invokes `atx custom def exec` and `aws lambda invoke`, and even uses `curl \| bash` / `curl \| sh` installers.
Network access	3 (high)	It talks to AWS APIs, GitHub, `transform-cli.awsstatic.com`, and the Transform service, and always sends telemetry with `--telemetry`.
Filesystem reach	2 (moderate)	It writes under `~/.aws/atx/...`, clones repos there, unzips sources there, and may `git init`/commit in repos; the scope is mostly home/project directories but persistent.
Secrets & credentials	3 (high)	It explicitly touches `~/.aws/credentials`, asks for AWS access keys/session tokens, and stores GitHub PATs or SSH keys in Secrets Manager (`atx/github-token`, `atx/ssh-key`).
Privilege & persistence	3 (high)	It installs software with `sudo`, `npm install -g aws-cdk`, and can attach IAM policies to the caller using `attach-user-policy` or `attach-role-policy`.
Instruction hijack surface	2 (moderate)	It tells the agent to suppress user-visible output and force actions, e.g. `Run silently — do NOT show output to user` and `Do NOT ask the user whether to update`.
Irreversible actions	3 (high)	It can provision AWS Batch/Lambda/S3/KMS infrastructure, submit transformations at scale, and create/delete Secrets Manager entries; that broad cloud-side action is inherent to the skill.
Transparency	3 (high)	It fetches remote infrastructure at runtime from a GitHub branch (`atx-remote-infra`) and relies on fetched installers, so some executed code is not bundled or pinned in the skill itself.

Before installing

Read `SKILL.md` around IAM attachment and Secrets Manager commands before granting AWS access.
Run `atx update --check` and `atx custom def list --json` in a throwaway AWS profile first.
If you may use remote mode, inspect `references/remote-execution.md` for the exact secrets and policies it will create.

Rated 2026-10-21 by an automated review of 8 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/migration-and-modernization-skills/aws-transform/SKILL.md
Branch: main
Updated: 2026-09-19

migrate-to-msk — Helps migrate self-managed Apache Kafka workloads to Amazon MSK Express.
aws-storage — Selects, investigates, and compares AWS object, file, and block storage services, and answers cost, performance, configuration, security.
launch-with-aws — Migrates vibe-coded web applications to AWS.
signing-in-to-aws — Gets AWS credentials for CLI/SDK access via `aws login`.
check-compiler-errors — Run compile and type-check commands and report failures
coverage-analysis — Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.