chatting-with-aws-devops-agent

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analysis, architecture, aws-devops, cloud, troubleshooting.

What it does

Have a fast, conversational analysis with the AWS DevOps Agent. Use for cost optimization, architecture review, topology mapping, knowledge / runbook discovery, security audits, dependency questions, and quick diagnostics — anything that needs a 5-30 second answer rather than a 5-8 minute deep investigation. Trigger words include cost, optimize, review, architecture, topology, what runbooks, show me, compare, audit, what if.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill chatting-with-aws-devops-agent

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/chatting-with-aws-devops-agent ~/.claude/skills/chatting-with-aws-devops-agent

Safety box score

Grade C, moderate risk: 26 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a thin wrapper for chatting with a remote AWS DevOps Agent, with an AWS CLI fallback if the remote server is unavailable. The main risks are network disclosure of local workspace context and the ability to run AWS CLI commands against the user’s AWS account.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	The fallback path runs shell commands like `aws devops-agent create-chat` and `aws devops-agent send-message`, but the skill does not ship scripts or evaluate arbitrary code.
Network access	2 (moderate)	It sends user questions and injected local context to a remote AWS DevOps Agent, and the fallback path also talks to AWS APIs over the network.
Filesystem reach	1 (low)	It encourages reading local workspace files such as `package.json`, IaC files, and `git log` to build context, but it does not write or delete files.
Secrets & credentials	1 (low)	The fallback AWS CLI calls will use whatever credentials are already configured locally, and the skill asks for workspace context that could accidentally include secrets.
Privilege & persistence	0 (none)	There is no sudo, service installation, shell startup editing, or other OS-wide privilege change in the skill.
Instruction hijack surface	0 (none)	The file does not ask the agent to ignore instructions, fetch remote prompts, or hide anything; it explicitly says not to auto-execute suggested commands.
Irreversible actions	2 (moderate)	It orchestrates multi-turn remote chats with `chat`, `send_message`, and `list_chats`, and can fall back to API calls without an extra human check.
Transparency	0 (none)	The skill is plain markdown with readable commands and no binaries, blobs, or runtime-decoded code.

Before installing

Check whether you are comfortable sending IaC, logs, and other local context to a remote AWS service.
Verify your AWS CLI credentials are configured, since the fallback path uses `aws devops-agent ...` commands.
Decide whether chat history reuse via `list_chats` and old `execution_id`s is acceptable for your data handling policy.

Rated 2026-10-15 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-agents-for-devsecops/skills/chatting-with-aws-devops-agent/SKILL.md
Branch: main
Collection: aws-agents-for-devsecops
Updated: 2026-09-19

coordinating-multi-space-devops-agent — Coordinate the AWS DevOps Agent across multiple AgentSpaces from one Claude Code session — route questions to the right space (prod vs staging vs knowledge).
investigating-incidents-with-aws-devops-agent — Run a deep root-cause investigation on the AWS DevOps Agent.
aws-database — Routes any task involving AWS databases — choosing, comparing, recommending, getting started with.
aws-networking — Routes AWS networking requests to the correct service skill for implementation.
agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
aws-ai-ml — Selects, deploys, and customizes AI models on Amazon SageMaker.