querying-aws-sagemaker-catalog

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, catalog, governance, ml, sql.

What it does

Runs SQL analytics on SageMaker Catalog asset metadata tables exported as Apache Iceberg in S3 Tables. Covers governance queries, asset growth tracking, ownership audits, time-travel over catalog state, and metadata quality analysis. Applies when querying catalog inventory, finding assets without descriptions, comparing catalog snapshots, or auditing data ownership. Trigger phrases: catalog inventory SQL, how many assets, assets without descriptions, asset growth over time, who owns this data, catalog governance, data quality audit, catalog analytics.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill querying-aws-sagemaker-catalog

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/system-table-skills/querying-aws-sagemaker-catalog ~/.claude/skills/querying-aws-sagemaker-catalog

Safety box score

Grade C, moderate risk: 37 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill uses AWS CLI commands to query and reconfigure SageMaker Catalog export data in S3 Tables, including DataZone export settings and Lake Formation permissions. The main risks are AWS-side configuration changes, granting read access to catalog metadata, and exposing sensitive organizational metadata in query results; it does not write local files or run arbitrary downloaded code.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It invokes shell commands through the AWS CLI, including `aws datazone get-data-export-configuration`, `aws datazone put-data-export-configuration`, `aws lakeformation grant-permissions`, and `aws glue get-tables`.
Network access	2 (moderate)	Those AWS CLI calls send requests to remote AWS services to read catalog state, enable exports, and grant permissions.
Filesystem reach	0 (none)	The skill only shows read-only markdown and no commands that read, write, or delete local files outside the project.
Secrets & credentials	1 (low)	It assumes configured AWS credentials and mentions IAM roles/temporary credentials, but it does not read secret files or ask the user to paste passwords or keys.
Privilege & persistence	2 (moderate)	It changes AWS service configuration and access control, including `put-data-export-configuration` and Lake Formation permission grants.
Instruction hijack surface	0 (none)	There are no instructions to ignore safeguards, hide behavior, or fetch and follow remote instructions.
Irreversible actions	2 (moderate)	The skill can enable catalog export and grant access, which are external administrative actions, though it does not itself deploy or delete data.
Transparency	0 (none)	The file is plain-text markdown with readable CLI examples; there are no binaries, installers, or encoded payloads.

Before installing

Read the sections with `put-data-export-configuration` and `grant-permissions` to confirm you want this skill to change AWS export and access settings.
Try it first in a sandbox AWS account/region with non-production Lake Formation and DataZone permissions.
Confirm the Athena/S3 Tables output location and KMS setup you want before letting an agent run queries.
Make sure the principals named in the examples are roles you are comfortable granting read access to.

Rated 2026-10-15 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/system-table-skills/querying-aws-sagemaker-catalog/SKILL.md
Branch: main
Updated: 2026-09-19

storing-and-querying-vectors — Store and query vector embeddings using Amazon S3 Vectors, a cost-effective long-term vector storage service with its own API namespace (s3vectors).
amazon-braket — Runs quantum computing workflows on AWS through Amazon Braket — discovering devices (QPUs and simulators) and their availability.
aurora-dsql — Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans.
aws-cleanrooms — Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions.
dms-schema-conversion — Handles the full DMS Schema Conversion lifecycle including creating migration projects, converting database schemas to a target engine.
querying-aws-cloudwatch — Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables.