See it in action
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
PromptWhich CloudTrail API event name corresponds to modifying rules within an AWS Network Firewall rule group list?
What was checked, without and with the skill| Checked | Without skill | With skill |
|---|
| Identifies UpdateFirewallRuleGroupRuleList as the event name. | Missed | Passed |
|---|
What's inside
The instructions your model reads when the skill loads.
SKILL.md94 linessingle file
AWS Security Audit
MCP Servers
- IAM MCP:
uvx awslabs.iam-mcp-server@latest --readonly (stdio transport)
- CloudTrail MCP:
uvx awslabs.cloudtrail-mcp-server@latest (stdio transport)
- Requires:
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)
Key Capabilities
IAM (Identity & Access Management)
- Users: List IAM users, access keys, MFA status, last activity
- Roles: List roles, trust policies, attached permissions
- Policies: Inspect policy documents, identify overly permissive policies
- Groups: List groups and their memberships
- Read-only mode:
--readonly flag prevents any IAM modifications
CloudTrail (API Audit Trail)
- Event history: Search recent API calls by user, service, or resource
- Lookup events: Filter by event name, resource type, username
- Time-based queries: Narrow to specific time windows around incidents
- Multi-region: Trail events across all enabled regions
Workflow: Network Security Audit
When a user asks "audit our AWS network security":
- IAM roles for network services: Check roles used by VPC, TGW, Network Firewall
- Overly permissive policies: Find policies with
ec2:* or *:* actions
- Unused access keys: Identify stale credentials that should be rotated
- MFA compliance: Check which users lack MFA
- CloudTrail check: Recent
AuthorizeSecurityGroupIngress, CreateNetworkAcl, ModifyVpcAttribute events
- Report: Security posture summary with remediation recommendations
Workflow: Incident Investigation
When investigating a security event:
Track record
Benchmark
18 / 21
test cases passed, vs 15 / 21 without
Adoption
- Users
- 0
- Times used
- 0
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
Importedautomateyournetwork / netclaw
workspace/skills/aws-security-audit/SKILL.md
License Apache-2.0Imported 8/3/2026Version v1