troubleshooting-application-failures

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analysis, aws, debugging, logs, troubleshooting.

What it does

Troubleshoots failing applications by discovering and analyzing CloudWatch log groups to identify error patterns, root causes, and actionable solutions. Use when an application is experiencing failures and log-based diagnosis is needed.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill troubleshooting-application-failures

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/operations-skills/troubleshooting-application-failures ~/.claude/skills/troubleshooting-application-failures

Safety box score

Grade C, moderate risk: 33 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only CloudWatch Logs troubleshooting workflow that discovers log groups, reads log streams, and runs Logs Insights queries in an AWS region. The main risks are broad exposure of application log data (including secrets if they are logged) and the fact that the documented commands interpolate user-supplied names into CLI command templates.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs the agent to run AWS CLI commands such as `aws logs describe-log-groups`, `aws logs start-query`, and `aws logs get-query-results`, which is active command execution even though it does not ship local scripts.
Network access	2 (moderate)	The workflow queries AWS CloudWatch Logs over the network and retrieves raw log contents from a remote region using `describe-log-groups`, `describe-log-streams`, `start-query`, and `get-query-results`.
Filesystem reach	0 (none)	The files do not instruct the agent to read, write, or delete local files outside the repository; the workflow is log-analysis only.
Secrets & credentials	2 (moderate)	It analyzes raw `@message` log data and can surface credentials or tokens if they were emitted to CloudWatch logs, so troubleshooting can expose sensitive data from the application environment.
Privilege & persistence	0 (none)	No sudo, service registration, shell startup edits, or other privilege-changing actions are requested; it only needs existing AWS credentials and permissions.
Instruction hijack surface	1 (low)	The command templates interpolate `${application_name}`, `${region}`, and `${log_group_name}` directly into CLI examples; if implemented via a shell without proper escaping, user-controlled names could alter the command.
Irreversible actions	1 (low)	The skill is read-only and asks the user to confirm discovered log groups before proceeding, but it still autonomously enumerates and analyzes logs once invoked.
Transparency	0 (none)	All provided files are plain Markdown with no binaries, encoded blobs, or hidden runtime-loaded content.

Before installing

Confirm the AWS role only has access to the intended log groups and that those logs do not contain secrets.
Review how the agent executes the documented commands; escape `application_name` and `log_group_name` if a shell is involved.
Test first in a sandbox account/region with a short time window and a non-production application.
Verify the needed CloudWatch Logs permissions and that you are comfortable with the agent reading raw log messages.

Rated 2026-10-16 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/operations-skills/troubleshooting-application-failures/SKILL.md
Branch: main
Updated: 2026-09-19

agents-debug — Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes.
investigating-incidents-with-aws-devops-agent — Run a deep root-cause investigation on the AWS DevOps Agent.
app-platform-troubleshooting — Debug running App Platform applications by accessing containers, analyzing logs, running diagnostics, and applying fixes.
principle-fix-root-causes — Apply when debugging.
debugging-lambda-timeouts — Debugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts.
debugging-wizard — Parses error messages, traces execution flow through stack traces, correlates log entries to identify failure points.