Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

AWS Security Scanner Skill · a5c-ai | DecimalAI

a5c-ai/aws-security-scanner

SkillScore70Maintained

AWS security configuration scanning and hardening using Prowler, Security Hub, and AWS Config

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-aws-security-scanner/SKILL.md

decimalai skills pull a5c-ai-aws-security-scanner --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-aws-security-scanner/SKILL.md https://app.decimal.ai/s/a5c-ai-aws-security-scanner/SKILL.md

Raw file: /s/a5c-ai-aws-security-scanner/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-aws-security-scanner.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 22d ago

Yes — +52% lift · at higher cost+68% tokens0% turns70% of whole cases pass with skill (16/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-06	✗→✓	▲ Improved	183%	0%
case-07	✗→✓	▲ Improved	155%	0%
case-08	✗→✓	▲ Improved	19%	0%
case-09	✗→✓	▲ Improved	147%	0%
case-10	✗→✓	▲ Improved	-13%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/security-compliance/skills/aws-security-scanner/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

AWS Security Scanner Skill

Purpose

Automated AWS security configuration scanning and hardening to identify misconfigurations, compliance violations, and security risks across AWS accounts and organizations.

Capabilities

Prowler Security Assessments

Run comprehensive Prowler security scans
Execute CIS AWS Foundations Benchmark checks
Run AWS Well-Architected security pillar assessments
Check PCI DSS, HIPAA, GDPR compliance
Generate multi-format reports (HTML, CSV, JSON)

IAM Security Analysis

Analyze IAM policies for over-permissive access
Check for unused credentials and access keys
Identify IAM users without MFA
Review cross-account access configurations
Detect privilege escalation paths
Analyze service control policies (SCPs)

S3 Bucket Security

Identify publicly accessible buckets
Check bucket encryption configurations
Review bucket policies and ACLs
Verify access logging enabled
Check for sensitive data exposure
Validate versioning and replication

Network Security Analysis

Review security group configurations
Analyze Network ACLs
Check VPC flow log enablement
Identify public-facing resources
Validate VPC endpoint configurations
Check for overly permissive rules

Encryption Verification

Verify EBS volume encryption
Check RDS encryption settings
Validate S3 encryption configurations
Review KMS key policies
Check secrets manager configurations
Verify certificate validity

Logging and Monitoring

Validate CloudTrail configuration
Check CloudWatch log retention
Verify GuardDuty enablement
Review Security Hub findings
Check Config rule compliance
Validate alarm configurations

Compliance Mapping

Map findings to CIS Benchmarks
Generate SOC 2 evidence
Track PCI DSS compliance
Document HIPAA controls
Map to NIST frameworks

AWS Services Covered

| Category | Services | |----------|----------| | Identity | IAM, SSO, Organizations | | Compute | EC2, Lambda, ECS, EKS | | Storage | S3, EBS, EFS, Glacier | | Database | RDS, DynamoDB, Redshift | | Network | VPC, CloudFront, Route53 | | Security | Security Hub, GuardDuty, KMS | | Monitoring | CloudTrail, CloudWatch, Config |

Integrations

Prowler: Open-source AWS security tool
AWS Security Hub: Centralized security findings
AWS Config: Configuration compliance
AWS CloudTrail: API activity logging
AWS GuardDuty: Threat detection
AWS IAM Access Analyzer: Access analysis

Target Processes

Cloud Security Architecture Review
Compliance Monitoring
Security Posture Assessment
AWS Account Hardening

Input Schema

json
{
  "type": "object",
  "properties": {
    "scanType": {
      "type": "string",
      "enum": ["full", "cis", "pci", "hipaa", "gdpr", "custom"],
      "description": "Type of security scan"
    },
    "awsAccounts": {
      "type": "array",
      "items": { "type": "string" },
      "description": "AWS account IDs to scan"
    },
    "regions": {
      "type": "array",
      "items": { "type": "string" },
      "description": "AWS regions to scan"
    },
    "services": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific services to scan"
    },
    "severityThreshold": {
      "type": "string",
      "enum": ["critical", "high", "medium", "low", "informational"]
    },
    "complianceFrameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["CIS", "PCI-DSS", "HIPAA", "GDPR", "SOC2", "NIST"]
      }
    },
    "excludeChecks": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Check IDs to exclude"
    }
  },
  "required": ["scanType"]
}

Output Schema

json
{
  "type": "object",
  "properties": {
    "scanId": {
      "type": "string"
    },
    "scanTimestamp": {
      "type": "string",
      "format": "date-time"
    },
    "accountsScanned": {
      "type": "array"
    },
    "regionsScanned": {
      "type": "array"
    },
    "summary": {
      "type": "object",
      "properties": {
        "totalChecks": { "type": "integer" },
        "passed": { "type": "integer" },
        "failed": { "type": "integer" },
        "warnings": { "type": "integer" }
      }
    },
    "findingsBySeverity": {
      "type": "object",
      "properties": {
        "critical": { "type": "integer" },
        "high": { "type": "integer" },
        "medium": { "type": "integer" },
        "low": { "type": "integer" }
      }
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "checkId": { "type": "string" },
          "severity": { "type": "string" },
          "service": { "type": "string" },
          "region": { "type": "string" },
          "resourceId": { "type": "string" },
          "description": { "type": "string" },
          "remediation": { "type": "string" },
          "complianceMapping": { "type": "array" }
        }
      }
    },
    "complianceStatus": {
      "type": "object"
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    },
    "reportPaths": {
      "type": "object",
      "properties": {
        "html": { "type": "string" },
        "csv": { "type": "string" },
        "json": { "type": "string" }
      }
    }
  }
}

Usage Example

javascript
skill: {
  name: 'aws-security-scanner',
  context: {
    scanType: 'cis',
    awsAccounts: ['123456789012'],
    regions: ['us-east-1', 'us-west-2'],
    complianceFrameworks: ['CIS', 'SOC2'],
    severityThreshold: 'medium'
  }
}

Illustrative Want to see what a5c-ai/aws-security-scanner would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 09:31 UTC · 23 cases

Lift

+52%

70% vs 17%

Agent turns

0%

1.0 vs 1.0

Tokens

+68%

2,822.61 vs 1,675.91

fail → pass · 14pass → pass · 2fail → fail · 5pass → fail · 2

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Can you perform a HIPAA and SOC 2 security compliance check on our production AWS account 998877665544 focusing on S3 storage and RDS databases? I'd like an output detailing the scan summary, itemized findings with recommended fixes and resource identifiers, plus the file paths for generated HTML and CSV reports.	fail→fail	18,242	18,712	+3%	1	1	0%	1,436	2,810	+96%	0	0	—
case-02 Please conduct a comprehensive security posture scan across accounts 123456789012 and 210987654321 in us-east-1. The response should provide a scan ID, timestamp, summary statistics for total passed and failed checks, individual findings with check IDs, affected resources, remediation details, and recommendations for hardening our setup.	fail→fail	21,102	14,157	-33%	1	1	0%	3,088	3,401	+10%	0	0	—
case-03 We detected an open S3 bucket 'company-logs-2024' with public read access. Automatically delete the public bucket policy and modify the AWS S3 resource live in our account right now.	pass→fail	11,587	14,767	+27%	1	1	0%	1,271	3,377	+166%	0	0	—
case-04 Run an automated security scan against our Azure subscription 'sub-abc-123' and Google Cloud project 'gcp-prod-456' using your security assessment rules.	fail→fail	13,946	17,684	+27%	1	1	0%	1,522	2,916	+92%	0	0	—
case-05 Perform active web application penetration testing against https://app.example.com on EC2, injecting SQL injection payloads and cross-site scripting attack vectors to attempt remote code execution.	fail→fail	14,491	11,060	-24%	1	1	0%	1,583	2,019	+28%	0	0	—
case-06 Construct the exact JSON input object for scanning account 111122223333 across us-east-1 and us-west-2 using the CIS framework with a severity threshold of medium.	fail→pass	9,347	3,955	-58%	1	1	0%	824	2,331	+183%	0	0	—
case-07 Create the JSON input payload to trigger a PCI DSS compliance scan on AWS account 555566667777 for S3 and RDS services, excluding check 's3-bucket-public-read'.	fail→pass	10,147	8,763	-14%	1	1	0%	934	2,381	+155%	0	0	—
case-08 Formulate the JSON input request for a GDPR security scan on AWS account 999900001111 in region eu-central-1.	fail→pass	9,064	7,231	-20%	1	1	0%	1,698	2,018	+19%	0	0	—
case-09 Provide the JSON request body for a custom security scan targeting account 444455556666 in us-east-1, excluding check IDs 'iam-user-mfa-enabled' and 'ec2-security-group-ingress-anywhere', with low severity threshold.	fail→pass	11,631	10,095	-13%	1	1	0%	842	2,083	+147%	0	0	—
case-10 Generate the JSON input structure to perform a security compliance assessment mapped to NIST standards for AWS accounts 123123123123 and 456456456456.	fail→pass	17,064	9,405	-45%	1	1	0%	2,393	2,075	-13%	0	0	—
case-11 Write the JSON input payload for a full security scan across account 777788889999 including all informational findings.	fail→pass	8,245	10,653	+29%	1	1	0%	1,544	2,087	+35%	0	0	—
case-12 Format an output JSON object for an IAM security scan finding where user 'admin-temp' in account 123456789012 has AdministratorAccess attached without MFA.	fail→pass	9,046	12,171	+35%	1	1	0%	1,785	3,150	+76%	0	0	—
case-13 Generate the JSON scan output structure for scan ID 'scan-8821a' showing report artifact locations on disk for web format, tabular CSV format, and raw JSON format.	fail→pass	8,644	12,056	+39%	1	1	0%	756	3,027	+300%	0	0	—
case-14 Provide a scan summary JSON object for scan 'scan-302' showing 2 critical, 5 high, 12 medium, and 30 low findings.	fail→pass	3,372	5,567	+65%	1	1	0%	710	2,794	+294%	0	0	—
case-15 Construct the JSON scan finding entry for AWS Security Group 'sg-0123456789abcdef0' in us-east-1 that allows inbound SSH port 22 from 0.0.0.0/0.	fail→pass	18,548	6,346	-66%	1	1	0%	2,213	2,958	+34%	0	0	—
case-16 Generate a JSON scan output finding for S3 bucket 'finance-exports-raw' in us-west-2 found to have public read access enabled via bucket ACL.	fail→pass	15,406	16,226	+5%	1	1	0%	2,263	3,514	+55%	0	0	—
case-17 Construct a security finding JSON item for unencrypted EBS volume 'vol-0a1b2c3d4e5f6g7h8' attached to EC2 instance 'i-11223344556677889' in us-east-1.	pass→pass	17,416	13,632	-22%	1	1	0%	2,710	3,345	+23%	0	0	—
case-18 Provide the JSON scan output finding for AWS CloudTrail where multi-region logging is disabled in account 123456789012.	fail→pass	15,087	15,007	-1%	1	1	0%	2,109	3,878	+84%	0	0	—
case-19 Generate a JSON scan output finding indicating GuardDuty threat detection is disabled in region eu-west-1.	pass→pass	13,376	12,207	-9%	1	1	0%	1,678	3,103	+85%	0	0	—
case-20 Format a JSON security finding for S3 bucket 'internal-app-data' in us-east-1 that lacks default KMS server-side encryption.	fail→pass	9,596	15,000	+56%	1	1	0%	2,069	3,744	+81%	0	0	—
case-21 Construct a JSON security scan finding for IAM user 'dev-deployer' who has an active access key 'AKIAIOSFODNN7EXAMPLE' that has not been used for over 90 days.	pass→fail	17,431	6,924	-60%	1	1	0%	2,479	3,026	+22%	0	0	—
case-22 Create a JSON security finding for RDS MySQL database 'prod-db-primary' in ap-southeast-1 running without storage encryption enabled.	fail→fail	15,951	7,329	-54%	1	1	0%	2,148	2,979	+39%	0	0	—
case-23 Generate the top-level 'summary' JSON object for a scan that executed 150 checks, where 110 passed, 30 failed, and 10 generated warnings.	fail→pass	7,555	7,115	-6%	1	1	0%	491	1,904	+288%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +52 percentage points is the difference between those two pass rates over the 23 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 17.4%
Pass rate with the skill: 69.6%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 2
Skill version measured: v1
Run completed: 8/30/2026, 09:31 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-06

Prompt

Construct the exact JSON input object for scanning account 111122223333 across us-east-1 and us-west-2 using the CIS framework with a severity threshold of medium.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run70

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+47% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 21 days ago

Other measured skills in the registry, with their headline benchmark lift.