exploring-data-catalog

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analysis, catalog, data, glue, inventory.

What it does

Full inventory and audit of AWS Glue Data Catalog assets across S3 Tables, Redshift-federated, and remote Iceberg catalogs. Triggers on: inventory the catalog, audit databases, list all tables, catalog overview, data landscape, enumerate catalogs, data inventory, search the catalog. Do NOT use for finding specific data (use finding-data-lake-assets), running queries (use querying-data-lake), or creating tables (use creating-data-lake-table).

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill exploring-data-catalog

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-data-analytics/skills/exploring-data-catalog ~/.claude/skills/exploring-data-catalog

Safety box score

Grade B, low risk: 19 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill performs broad, read-only inventory of AWS Glue Data Catalog assets across Glue, S3 Tables, Redshift-federated, and remote Iceberg catalogs. The main risks are wide AWS/network reach, exposure to customer-authored metadata from experimental Glue Discovery APIs, and the ability to read a user-supplied spec file.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It drives shell/AWS CLI commands such as `aws sts get-caller-identity`, `aws glue get-catalogs --recursive --include-root`, and `aws s3tables list-tables`, but it does not evaluate arbitrary code or run downloaded scripts.
Network access	2 (moderate)	The skill necessarily sends requests to AWS Glue/S3 Tables and may query remote federated catalogs, so it has broad outbound metadata access across the account and connected sources.
Filesystem reach	1 (low)	It must accept a direct argument or a pointer to a file containing the spec, which implies local file reads, but there is no write/delete behavior.
Secrets & credentials	0 (none)	It does not request passwords, tokens, key files, `.env` files, keychains, or browser sessions; `aws sts get-caller-identity` only checks existing AWS identity.
Privilege & persistence	0 (none)	There is no sudo, service installation, shell startup editing, or OS/git setting changes in the skill.
Instruction hijack surface	1 (low)	It explicitly consumes customer-authored Glue Discovery content (`Description`, `Forms`) and warns it is untrusted, so prompt-injection risk exists via remote metadata even though the skill tells the agent not to follow such instructions.
Irreversible actions	0 (none)	The skill is read-only and does not push, publish, send messages, book, pay, or delete anything.
Transparency	0 (none)	All shipped files are plain Markdown; there are no binaries, hidden blobs, or decoded-at-runtime code.

Before installing

Confirm you are comfortable granting read-only AWS metadata access for the chosen account and region.
Test the AWS profile/role it will use with `aws sts get-caller-identity` before letting the agent run discovery.
If you might use the experimental Glue Discovery lookup, decide up front whether exposing customer-authored catalog metadata is acceptable.
Review any local spec files you may point it at and avoid giving it paths to unrelated sensitive files.

Rated 2026-10-20 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-data-analytics/skills/exploring-data-catalog/SKILL.md
Branch: main
Collection: aws-data-analytics
Updated: 2026-09-19

finding-data-lake-assets — Resolve data lake and lakehouse asset references across Glue Data Catalog, S3, S3 Tables, and Redshift.
creating-data-lake-table — Create managed Iceberg tables using Amazon S3 Tables (s3tables API namespace) with automatic compaction and snapshot management.
competitor-profiling — When the user wants to research, profile, or analyze competitors from their URLs.
principle-foundational-thinking — Apply before writing logic: choosing core types and data structures, sequencing scaffold-vs-feature work, asking what concurrent actors share.
prospecting — When the user wants to find, qualify, and build a list of prospects to reach out to — across B2B SaaS, general B2B, or local small businesses.
gemini-history-analyzer — Analyze Google Takeout exports of Gemini conversation history.