Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add automateyournetwork/netclaw --skill aws-network-opsgit clone --depth 1 https://github.com/automateyournetwork/netclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/automateyournetwork/netclaw/aws-network-ops)<a href="https://agentmods.dev/skills/automateyournetwork/netclaw/aws-network-ops"><img src="https://agentmods.dev/badge/skills/automateyournetwork/netclaw/aws-network-ops.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 33 uvx/uv tool run commands without ==version create a rug-pull risk.Fix: Pin the version: uvx package-name==1.2.3
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.01574 |
| Opus 5 | $0.00028 | $0.00787 |
| Sonnet 5 | $0.00011 | $0.00315 |
| Haiku 4.5 | $0.00006 | $0.00157 |
Grade A, and why
aws-network-ops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AWS Network Operations
MCP Server
- Command:
uvx awslabs.aws-network-mcp-server@latest(stdio transport) - Requires:
AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_REGION(orAWS_PROFILE) - Read-only: All operations are Describe/Get/List — no create/modify/delete
Available Tools (27)
General (3)
| Tool | What It Does |
|---|---|
get_path_trace_methodology |
Guidance for tracing network paths across AWS resources |
find_ip_address |
Find which VPC/subnet/ENI an IP address belongs to |
get_eni_details |
Get Elastic Network Interface details — security groups, subnet, routes |
VPC (3)
| Tool | What It Does |
|---|---|
list_vpcs |
List all VPCs in the account/region |
get_vpc_network_details |
Full VPC details — subnets, route tables, IGW, NAT GW, endpoints, NACLs |
get_vpc_flow_logs |
Query VPC flow logs for traffic analysis |
Transit Gateway (7)
| Tool | What It Does |
|---|---|
list_transit_gateways |
List all Transit Gateways |
get_tgw_details |
Transit Gateway details — attachments, route tables, associations |
get_tgw_routes |
Get routes from a specific TGW route table |
get_all_tgw_routes |
Get routes from all TGW route tables |
get_tgw_flow_logs |
Query Transit Gateway flow logs |
list_tgw_peerings |
List TGW peering connections |
detect_tgw_inspection |
Detect if traffic inspection is configured on a TGW |
Cloud WAN (10)
| Tool | What It Does |
|---|---|
list_core_networks |
List all Cloud WAN core networks |
get_cloudwan_details |
Core network details — segments, policies, attachments |
get_cloudwan_routes |
Get routes from a Cloud WAN segment |
get_all_cloudwan_routes |
Get routes from all Cloud WAN segments |
get_cloudwan_attachment_details |
Details for a specific Cloud WAN attachment |
detect_cloudwan_inspection |
Detect inspection configuration on Cloud WAN |
list_cloudwan_peerings |
List Cloud WAN peering connections |
get_cloudwan_peering_details |
Details for a specific Cloud WAN peering |
get_cloudwan_logs |
Query Cloud WAN logs |
simulate_cloud_wan_route_change |
Simulate a route change and predict impact |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 153 lines · 55 tokens per session scan A 7abc82e01cb4
aws-network-ops is a skill published in the GitHub repository automateyournetwork/netclaw (650 stars, last pushed yesterday), licensed Apache-2.0. It adds 55 tokens to every session and 1,574 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cis-aws-foundations-4.7
Ensure VPC flow logging is enabled in all VPCs.
network-and-transfer-cost-audit
Analyzes AWS networking and data transfer costs across public IPv4 addresses, NAT Gateway, Transit Gateway, VPC peering, PrivateLink interface endpoints, inter-AZ, inter-region, and internet egress. Identifies top cost drivers, surfaces VPC endpoint savings opportunities, and guides progressive investigation using…
cis-aws-foundations-3.2.3
Ensure that RDS instances are not publicly accessible.
cis-aws-foundations-6.5
Ensure the default security group of every VPC restricts all traffic.
cis-aws-foundations-6.8
Ensure VPC Endpoints are used for access to AWS Services.
cis-aws-foundations-5.12
Ensure changes to network gateways are monitored.