Agent Toolkit for AWS is a collection of AWS-supported MCP servers, skills, plugins, commands, and hooks that help AI coding agents build, deploy, and manage applications on AWS. It is used by developers working with AWS services through agents such as Claude Code, Codex, Cursor, and Kiro. The catalogue entries are the toolkit's own agent extensions for AWS development and operations.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aws/agent-toolkit-for-aws --skill amazon-braketgit clone --depth 1 https://github.com/aws/agent-toolkit-for-awsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aws/agent-toolkit-for-aws/amazon-braket)<a href="https://agentmods.dev/skills/aws/agent-toolkit-for-aws/amazon-braket"><img src="https://agentmods.dev/badge/skills/aws/agent-toolkit-for-aws/amazon-braket/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aws/agent-toolkit-for-aws/amazon-braket"><img src="https://agentmods.dev/badge/skills/aws/agent-toolkit-for-aws/amazon-braket.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 47 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00089 | $0.03741 |
| Opus 5 | $0.00044 | $0.01870 |
| Sonnet 5 | $0.00018 | $0.00748 |
| Haiku 4.5 | $0.00009 | $0.00374 |
Grade A, and why
amazon-braket scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Amazon Braket
Primitives
The vocabulary of a Braket workflow, and which reference to open for each.
| Primitive | What it is | Related References | Open it when the request involves |
|---|---|---|---|
| Device | A simulator or QPU, identified by a region-scoped ARN | devices.md | anything about a device: what exists, discovering or filtering the fleet, availability and status (online, offline, retired), which region a device lives in, ARNs, choosing a device for a workload, qubit count, connectivity or topology, native gates, fidelities, calibration data, queue depth, shot and gate limits, paradigm (gate-model vs analog Hamiltonian simulation), whether a device supports program sets, pulse-level control, simulators and local emulators |
| Program | The workload/input — one executable (Circuit, AHS, OpenQASM). Which type is legal depends on the device's paradigm | - | - |
| Quantum task | One program + shots, run once (the atomic unit Braket meters) | - | - |
| Task batch | Many independent tasks — SDK-only fallback for when a program set does not fit; works on all devices | program-sets.md | see the Program set row; also running multiple programs |
| Program set | Many programs in one service-side task — preferred way to run multiple programs instead of task batch | program-sets.md | running more than one program: parameter sweeps, scanning parameter values, task batches, run_batch, several circuits submitted together, attaching observables across programs, and minimizing per-task fees when many programs run, program sets. Also getting started with program sets |
| Hybrid job | Managed classical-quantum loop that orchestrates many tasks | hybrid-job.md | hybrid jobs: @hybrid_job, algorithm scripts and source modules, entry_point, embedded simulators, BYOC and custom container images, CUDA-Q, job execution roles, hyperparameters, checkpoints, and retrieving job results |
| Spending limit | Service-side hard cap that rejects QPU tasks — the only true enforcement (not SDK) | spending-limit.md | capping or enforcing spend: spending limits (create, update, delete, search), and cost guardrails |
| Cost tracking | In-session cost estimate (not enforcement) | spending-limit.md | in-session cost tracking with Tracker |
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 153 lines · 89 tokens per session scan A b1bf60b9f073
amazon-braket is a skill published in the GitHub repository aws/agent-toolkit-for-aws (2,569 stars, last pushed yesterday), licensed Apache-2.0. It adds 89 tokens to every session and 3,741 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
arboreto
Infer gene regulatory networks (GRNs) from gene expression data using scalable algorithms (GRNBoost2, GENIE3). Use when analyzing transcriptomics data (bulk RNA-seq, single-cell RNA-seq) to identify transcription factor-target gene relationships and regulatory interactions. Supports distributed computation for…
torchdrug
Build and troubleshoot TorchDrug 0.2.1 workflows for molecular graphs, property prediction, self-supervised pretraining, molecule generation, retrosynthesis, protein representation learning, and knowledge graph reasoning. Use when code imports torchdrug or needs its datasets, models, tasks, or Engine.
deepspot-m
Generate transcriptome-wide virtual spatial transcriptomics from H&E histology with DeepSpot-M. Use when you need spatial gene expression in log1p-CPM for 224x224 tiles at about 20x, want to query protein-coding genes by symbol instead of a fixed panel, or want to run prediction across a whole slide after tiling with…
pyhealth
Build clinical/healthcare deep-learning pipelines with PyHealth — loading EHR/signal/imaging datasets (MIMIC-III/IV, eICU, OMOP, SleepEDF, ChestXray14, EHRShot), defining tasks (mortality, readmission, length-of-stay, drug recommendation, sleep staging, ICD coding, EEG events), instantiating models (Transformer…
pick-a-pii-model
Select an on-device OpenMed PII model from the committed registry by language, runtime format, and size budget, then require recall validation before deployment. Use when an agent must choose a local PII detector for CPU, Apple Silicon, or a mobile export without relying on live model discovery.
evo2
Score, embed, and generate DNA sequences with Evo 2, a long-context genomic foundation model. Use this skill when: (1) Computing per-nucleotide or per-sequence likelihoods for variant effect scoring, (2) Embedding genomic windows for downstream classification, (3) Generating DNA conditioned on a prefix, (4) Scoring…