remediating-with-aws-security-agent

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: code-quality, review, security, triage, validation.

What it does

Pull AWS Security Agent findings (penetration tests and code reviews) and drive remediation. Use this whenever the user mentions Security Agent, security findings, pentest or penetration test results, code review findings, vulnerabilities found in their AWS account, "what did the security scan find", remediating or triaging security risks, or wants to start fixing reported vulnerabilities — even if they don't name the service explicitly. Trigger it for phrases like "get my security findings", "what vulnerabilities do we have", "let's fix the pentest results", or "triage the security report". The skill discovers scans, exports findings to a gitignored local directory (so sensitive exploit detail is never committed), produces a prioritized triage summary, and offers to start fixing the highest-risk issues.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill remediating-with-aws-security-agent

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/remediating-with-aws-security-agent ~/.claude/skills/remediating-with-aws-security-agent

Safety box score

Grade C, moderate risk: 26 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill uses the AWS CLI to enumerate Security Agent scans and export full findings into a local `.security-agent/` directory, then triages them and can help edit code after user approval. The main risks are live access to the user's AWS account data and local persistence of sensitive exploit detail, including possible leaked secrets.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly runs live shell commands via the AWS CLI (`aws securityagent list-*`, `batch-get-findings`, `aws sts get-caller-identity`).
Network access	2 (moderate)	The skill sends authenticated requests to AWS Security Agent/STS and pulls findings from the user's AWS account and Region.
Filesystem reach	1 (low)	It writes exported reports into the repo under `.security-agent/` and creates `.security-agent/.gitignore`, but stays inside the working tree.
Secrets & credentials	1 (low)	The exported findings may include leaked secrets or environment details; the skill also tells the agent not to paste that detail into chat.
Privilege & persistence	0 (none)	There is no sudo, service registration, global install, or shell/OS configuration change in the skill.
Instruction hijack surface	0 (none)	The confirmation-related text is a guardrail to ask before exporting; there is no instruction to ignore higher-priority rules or follow hidden/remote prompts.
Irreversible actions	1 (low)	After user approval it can proceed to apply fixes in the repo, but it does not push, deploy, post, pay, or delete on its own.
Transparency	0 (none)	The skill is plain markdown with explicit commands; there are no binaries, installers, or decoded blobs.

Before installing

Confirm your AWS CLI profile and Region point at the intended account before running it.
Check that `.security-agent/` is acceptable local storage for sensitive findings on this machine.
Review the repo-to-scan matching step so you do not rely on a bad guess before exporting.
If the machine is shared, decide whether those exported reports could be copied or synced elsewhere.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-agents-for-devsecops/skills/remediating-with-aws-security-agent/SKILL.md
Branch: main
Collection: aws-agents-for-devsecops
Updated: 2026-09-19

differential-review — Performs security-focused differential review of code changes.
principle-test-behavior-not-implementation — Apply when you write, change, or keep a test. Call the code the way its users do and assert the result they observe against a literal expected value.
thermo-nuclear-code-quality-review — Run an extremely strict maintainability review for abstraction quality, giant files, and spaghetti-condition growth.
thermo-nuclear-review — Comprehensive security and correctness audit of a branch's changes.
typescript-best-practices — TypeScript best practices. Use when reading or editing any .ts or .tsx file.
docs-cleaner — Consolidates redundant documentation while preserving all valuable content; keeps a doc set truthful after things change.