{"id":"cmv0ei7ly7o5rad06fspedmn6","slug":"aws-security","publicId":"4bf2adf5-27f1-45e4-bf78-ac99ed4919ab","name":"aws-security","description":"AWS security service suitability, coverage and cost recommendations: WAF/origin overlap, AWS Network Firewall inspection coverage and policy review, VPC endpoint, Transit Gateway/Cloud WAN segmentation and DNS Firewall security-control suitability, certificate renewal ownership and monitoring, incident response triage ownership, centralized security log store (CloudWatch or Security Lake). Also factual configuration, findings, data sources and severity scoring for GuardDuty, Inspector, Security Hub V2/OCSF (Exposure, connectors, automation), Security Hub CSPM/ASFF (standards, controls), Macie, Detective, Security Lake, AWS Security Incident Response membership and case coverage, and Organizations security policies. Applies to advisory security-service choices even when one service is named. Implementation, rule or code authoring, deployment, scans and troubleshooting outside these factual procedures belong to specialist skills. Supports local AWS CLI and AWS MCP.","version":"2","author":"aws","license":"Apache-2.0","compatibility":"","status":"completed","overallGrade":"B","scannerVersion":11,"fileCount":37,"hasSkillMd":true,"hasScripts":false,"hasReferences":true,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/core-skills/aws-security","createdAt":"2026-10-09T03:23:46.823Z","completedAt":"2026-10-09T03:23:46.821Z","visibility":"public","publishedAt":"2026-08-25T20:15:01.828Z","category":"","frameworks":[],"badgeStatus":"conditional","downloadCount":0,"verdictRationale":{"summary":"Skill has warnings: 1 warning in security or structure checks.","verdict":"warn","scanners":[{"source":"vettd","weight":1,"verdict":"warn"},{"source":"cisco","weight":0.8,"verdict":"pass"}],"consensus":"warn","warnTriggers":["References external URL — review for indirect prompt injection risk"],"policyVersion":"consensus-v1","hardFailTriggers":[]},"verdictPolicyVersion":"consensus-v1","skillId":"cmt93tcpt30kqad09eyfb5x0r","findings":[{"id":"cmv0ei7ly7o5sad0645hgyivw","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42638a8b7e9fc5df27449992eaebc724","filepath":"SKILL.md"},{"id":"cmv0ei7ly7o5tad06ktr6x2c2","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"592f7ac7731768f0fd0bba83f30850f9","filepath":"SKILL.md"}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"A","findingCount":1,"criticalCount":0,"highCount":0},{"source":"vettd","status":"success","verdict":null,"grade":"B","findingCount":1,"criticalCount":0,"highCount":0}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":{"owner":"aws","name":"agent-toolkit-for-aws"},"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T06:59:40.405Z","lastVerifiedAt":"2026-10-22T06:59:40.405Z","lastChangeDetectedAt":"2026-10-08T19:23:20.345Z","scannedHash":"73fbfabb801bccf792e2e962b19e6af334a5d0ce","latestUpstreamHash":"73fbfabb801bccf792e2e962b19e6af334a5d0ce","nextCheckDueAt":"2026-10-23T09:00:23.618Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":{"form":"measured","magnitudes":[{"ruleId":"performance/static-context-tokens","label":"Static context tokens","value":3006,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body"}]},"rows":[{"origin":"signal","id":"cmv0ei7sp7o6uad060vhczea6","subjectType":"skill_audit","subjectId":"cmv0ei7ly7o5rad06fspedmn6","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/progressive-disclosure","severity":null,"label":"Progressive disclosure","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-09T03:23:45.000Z","payload":null},{"origin":"signal","id":"cmv0ei7q07o60ad06vva0f2vn","subjectType":"skill_audit","subjectId":"cmv0ei7ly7o5rad06fspedmn6","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/static-context-tokens","severity":null,"label":"Static context tokens","detail":null,"valueNum":3006,"valueText":null,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body","derivation":null,"confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-09T03:23:45.000Z","payload":null}]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":{"form":"unjudged"},"rows":[{"origin":"signal","id":"cmv0ei7q67o62ad06d8nj67dg","subjectType":"skill_audit","subjectId":"cmv0ei7ly7o5rad06fspedmn6","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-environment-assumptions","severity":null,"label":"Declared environment assumptions","detail":null,"valueNum":null,"valueText":"","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-09T03:23:45.000Z","payload":null},{"origin":"signal","id":"cmv0ei7ra7o6ead06v0nixbis","subjectType":"skill_audit","subjectId":"cmv0ei7ly7o5rad06fspedmn6","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-name","severity":null,"label":"Declared skill name","detail":null,"valueNum":null,"valueText":"aws-security","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-09T03:23:45.000Z","payload":null}]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":25,"publisherSupplied":["name","description","author","version","license"]}