running-release-tests

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: api, automation, qa, testing, web.

What it does

Run automated release testing (UI or API) via the AWS DevOps Agent using a pre-configured test profile. Use when the user wants to validate multi-step workflows, verify features, check for regressions, or test API endpoints. Trigger words include run tests, UAT, test my app, test profile, UI test, API test, automated testing, regression test, QA, end-to-end test, run the QA agent.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill running-release-tests

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/running-release-tests ~/.claude/skills/running-release-tests

Safety box score

Grade C, moderate risk: 26 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill runs cloud-based release tests through AWS DevOps Agent and the AWS CLI, so it will send your profile ID, optional test requirement, and job-monitoring requests to remote services. The main risks are remote-job autonomy, network exposure to AWS, and a local markdown report write; there is no evidence of arbitrary code execution or hidden content.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It directs the agent to run shell/AWS CLI commands and polling loops such as `aws devops-agent list-agent-spaces --region us-east-1`, but it does not execute arbitrary code or download scripts.
Network access	2 (moderate)	It sends requests to AWS DevOps Agent APIs and the fallback AWS CLI, including `test_profile_id` and optional `webhookEventMessage`, and retrieves journal records/reports from remote services.
Filesystem reach	1 (low)	The only local write is the markdown report file `release-testing-report-<YYYY-MM-DD-HHmmss>.md`; no broader file editing or deletion is described.
Secrets & credentials	1 (low)	It assumes pre-existing test profiles contain credentials and mentions bearer-token/auth failures, but it does not ask the user to paste secrets or read local secret stores.
Privilege & persistence	0 (none)	No sudo, global installs, services, shell startup edits, or OS configuration changes are requested.
Instruction hijack surface	0 (none)	I found workflow instructions, but no prompt-injection behavior such as ignoring rules, hiding content, or following remote instructions; the scan hint appears to be a false positive.
Irreversible actions	2 (moderate)	It can create, monitor, and cancel remote release-testing jobs on the user's behalf, but only after the user selects a profile and agent space.
Transparency	0 (none)	The skill is a single readable Markdown file; there are no binaries, blobs, or unreviewable generated installers.

Before installing

Verify the chosen test profile points to a non-production environment and intended AWS account/space.
Confirm your AWS credentials or bearer token are scoped to the agent space you plan to use.
Decide whether timestamped report files in the current directory are acceptable.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-agents-for-devsecops/skills/running-release-tests/SKILL.md
Branch: main
Collection: aws-agents-for-devsecops
Updated: 2026-09-19

gh-cli — Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns.
agent-web-search-setup — Sets up working web search on an agent whose model backend cannot run it.
csharp-developer — Use when building C# applications with .NET 8+, ASP.NET Core APIs, or Blazor web apps. Builds REST APIs using minimal or controller-based routing.
dev-browser — Browser automation with persistent named pages via the dev-browser CLI.
fastapi-expert — Use when building high-performance async Python APIs with FastAPI and Pydantic V2.
fullstack-guardian — Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.