resilience-hub-failure-mode-assessment

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analysis, aws, resilience, triage, validation.

What it does

Runs and interprets AWS Resilience Hub v2 failure mode assessments. Covers starting assessments, understanding findings (severity, categories, recommendations), triaging by achievability, working with AI-generated service functions, and resolving findings. Applies when the user wants to run an assessment, review findings, or understand failure modes, or has a specific finding and asks how to resolve, remediate, or fix it. Does not apply to initial setup (use resilience-hub-getting-started) or FIS experiments.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill resilience-hub-failure-mode-assessment

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/resilience-skills/resilience-hub-failure-mode-assessment ~/.claude/skills/resilience-hub-failure-mode-assessment

Safety box score

Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill runs AWS Resilience Hub failure mode assessments, reads findings, and can update service functions, finding status, and report exports. The main risks are remote AWS network access and state-changing account mutations, plus sensitive architecture data being written to S3 reports.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It shells out to AWS CLI commands such as `command -v aws`, `aws resiliencehubv2 start-failure-mode-assessment`, and `aws resiliencehubv2 create-report`.
Network access	2 (moderate)	It sends data to AWS services and can write report output to S3 (`create-report`, `reportConfiguration`, `s3ReportOutput.s3ObjectKey`).
Filesystem reach	0 (none)	The files do not describe writing or deleting anything outside the working directory; the only local paths referenced are the skill's own markdown references.
Secrets & credentials	1 (low)	It relies on the user's authenticated AWS CLI/MCP session and warns that assessment reports may contain sensitive architectural detail, but it does not ask for API keys, passwords, or other secret material.
Privilege & persistence	1 (low)	It needs the caller's AWS IAM permissions to read and mutate Resilience Hub and S3 resources, but it does not request sudo, OS-level changes, or service registration.
Instruction hijack surface	0 (none)	There is no instruction to ignore higher-priority guidance, hide actions, or follow untrusted fetched content; the files are procedural AWS steps.
Irreversible actions	2 (moderate)	It can start billable assessments, create reports, and update AWS state via `start-failure-mode-assessment`, `update-service-function`, and `update-failure-mode-finding`.
Transparency	0 (none)	All shipped files are plain markdown with readable commands; there are no binaries, encoded blobs, or unpinned installers.

Before installing

Confirm the AWS identity you will let this skill use (`aws sts get-caller-identity`) is least-privilege for only the intended Resilience Hub service and regions.
Review `references/assessment-workflow.md` and decide whether you are comfortable allowing the agent to call `update-service-function`, `update-failure-mode-finding`, and `create-report`.
Verify the report S3 bucket is private and encrypted before allowing report generation, because the skill says reports may contain sensitive architectural detail.
If you only want read-only review, do not grant permissions that allow mutation of Resilience Hub findings or service functions.

Rated 2026-10-20 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/resilience-skills/resilience-hub-failure-mode-assessment/SKILL.md
Branch: main
Updated: 2026-09-19

triage-issue-reports — Triage Slack issue reports with one thread-only verdict, evidence review, cause-aware routing, tracker dedupe, and fail-closed ticket creation.
resilience-hub-getting-started — Sets up AWS Resilience Hub v2 from scratch: creates resilience policies with SLO targets, registers systems and user journeys.
continue-claude-code-work — Continues interrupted Claude Code work only after local history has been read and reconciled.
continue-codex-work — Continues interrupted OpenAI Codex work only after read-codex-history verifies the selected rollout identity and complete fork/compaction lineage.
aws-database — Routes any task involving AWS databases — choosing, comparing, recommending, getting started with.
aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.