setup-security-agent
An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: automation, cloud, mcp, security, setup.
What it does
Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket. Use when the user asks to "set up security agent", "configure security scanner", "is security agent configured", or on first-time use before any scan or pentest.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add aws/agent-toolkit-for-aws --skill setup-security-agentOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/setup-security-agent ~/.claude/skills/setup-security-agentSafety box score
Grade C, moderate risk: 30 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill provisions AWS Security Agent prerequisites: an agent space, an IAM service role, and an S3 bucket, while also writing workspace state under `.security-agent/`. The main risks are automatic AWS-side mutations through the AWS CLI and use of the caller’s active AWS credentials to create or update cloud resources.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It directs the agent to run shell commands such as `aws sts get-caller-identity`, `aws iam create-role`, and `aws s3api create-bucket`, so setup executes local commands rather than being read-only. |
| Network access | 2 (moderate) | The workflow talks to AWS services (`sts`, `securityagent`, `iam`, `s3api`) and sends account/resource data over the network as part of setup. |
| Filesystem reach | 1 (low) | It writes workspace state to `.security-agent/config.json` and `.security-agent/.gitignore`, and also creates temporary files under `/tmp/sa-*.json` and `/tmp/sa-*.err`. |
| Secrets & credentials | 1 (low) | It relies on the user’s ambient AWS CLI credentials via commands like `aws sts get-caller-identity`, so the skill uses whatever logged-in AWS identity is active. |
| Privilege & persistence | 0 (none) | It does not request sudo, install system-wide software, register services, or change shell/OS settings on the machine. |
| Instruction hijack surface | 0 (none) | No prompt-injection patterns or remote instruction-following are present; the file only contains setup steps and guardrails. |
| Irreversible actions | 2 (moderate) | It can automatically create or update AWS resources (`create-agent-space`, `create-role`, `create-bucket`, `update-agent-space`) with only limited user confirmation when multiple agent spaces already exist. |
| Transparency | 0 (none) | There are no binaries, minified blobs, or remotely fetched scripts; the skill content is fully readable Markdown. |
Before installing
- Confirm you want this workspace to create or reuse `SecurityAgentScanRole` and `security-agent-scans-$ACCOUNT-$REGION` in your AWS account.
- Verify the AWS profile/credentials active in your shell are the ones you intend this skill to use.
- Check whether you want `.security-agent/` kept untracked via the generated `.gitignore`.
- If your account already has multiple Security Agent spaces, decide which one should be reused before running setup.
Rated 2026-10-20 by an automated review of 1 file from the skill's repository.
Source
- Repository
- aws/agent-toolkit-for-aws (all skills from this repository)
- Path
- plugins/aws-agents-for-devsecops/skills/setup-security-agent/SKILL.md
- Branch
- main
- Collection
- aws-agents-for-devsecops
- Updated
- 2026-09-19
Related skills
- setup — Set up the AWS DevOps Agent and AWS Security Agent connections. Use when the user says "set up", "configure", "connect", or when MCP tools are missing.
- agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
- setting-up-ec2-instance-profiles — Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials.
- cloud-architect — Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure.
- unity-package-management — Use when adding, removing, upgrading, or discovering Unity (UPM) packages programmatically from outside the Editor — headless or CI package installs via the C#.
- coordinating-multi-space-devops-agent — Coordinate the AWS DevOps Agent across multiple AgentSpaces from one Claude Code session — route questions to the right space (prod vs staging vs knowledge).