Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aws/tools-for-devops-agent --skill aws-vpc-dns-investigationgit clone --depth 1 https://github.com/aws/tools-for-devops-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aws/tools-for-devops-agent/aws-vpc-dns-investigation)<a href="https://agentmods.dev/skills/aws/tools-for-devops-agent/aws-vpc-dns-investigation"><img src="https://agentmods.dev/badge/skills/aws/tools-for-devops-agent/aws-vpc-dns-investigation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aws/tools-for-devops-agent/aws-vpc-dns-investigation"><img src="https://agentmods.dev/badge/skills/aws/tools-for-devops-agent/aws-vpc-dns-investigation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00186 | $0.01871 |
| Opus 5 | $0.00093 | $0.00936 |
| Sonnet 5 | $0.00037 | $0.00374 |
| Haiku 4.5 | $0.00019 | $0.00187 |
Grade A, and why
aws-vpc-dns-investigation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Investigate VPC DNS Resolution
Use the tools on the connected aws-vpc-dns-diagnostics MCP server.
Step 1: Classify the request as Mode A or Mode B
Before calling any tool, determine which mode applies:
- Mode A (live diagnosis): The operator reports a resolution symptom from a running instance. They provide an instance ID (or you can identify one). The goal is to observe what actually resolves and compare resolvers.
- Mode B (pre-change validation): The operator asks whether a proposed DNS change is safe. They provide account, region, VPC, and a change descriptor. No instance is required.
If the request is ambiguous, ask the operator to clarify. Do not default to Mode A when the input lacks an instance ID, and do not default to Mode B when the operator describes a live symptom.
Step 2: Load safety rules
Regardless of mode, call get_sop with slug A-critical-safety-rules and
follow every rule it contains. These are non-negotiable constraints on how you
interpret results, handle opaque constructs, and report findings.
Mode A route: live diagnosis
Required inputs
account_id, region, instance_id, and the failing DNS name.
Tool sequence (in order)
dns_probe_context— establishes VPC-attribute preconditions: enableDnsSupport, enableDnsHostnames, address family, DHCP option set. A resolution result means nothing until you know whether the VPC resolver is answering.dns_probe_compare— runs the allowlisted probe set inside the instance via SSM. Returns each resolver's answer and the resolver's own identity fromhostname.bind. The VPC DHCP resolver is auto-added for comparison.get_sop— load the pattern runbook matching the observed signature (see trap-to-SOP mapping below).
Interpretation rules
- If
enableDnsSupportis false: loadA-resolver-disabled-precondition. The VPC resolver is intentionally dark and every probe failure follows from that. - Compare the instance's
/etc/resolv.conf(from the probe output) against the DHCP option set. A mismatch means the instance is not using the VPC-intended resolver. - Judge answers by name category (load
A-name-category-classification), not by whether resolvers agree. Two resolvers returning the same wrong answer is still a failure.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 172 lines · 186 tokens per session scan A 4d472d357a1c
aws-vpc-dns-investigation is a skill published in the GitHub repository aws/tools-for-devops-agent (45 stars, last pushed 4d ago), licensed Apache-2.0. It adds 186 tokens to every session and 1,871 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hyperpod-node-debugger
Diagnose and remediate per-node issues on a HyperPod cluster (EKS or Slurm) — a specific node is unhealthy, unresponsive, stuck, or needs replacing. Covers on-node EFA, GPU / accelerator hardware (XID, ECC, NVLink, row-remap, DCGM), Slurm node down/drained, disk and memory pressure, per-node lifecycle-script failures…
hyperpod-performance-debugger
Diagnose performance issues on Amazon SageMaker HyperPod clusters — uneven NCCL bandwidth across nodes and poor filesystem throughput. Read-only. Surfaces host-side signals (Xid, ECC, NVLink, EFA reachability, FSx saturation) and routes to the appropriate sibling skill (hyperpod-node-debugger, hyperpod-nccl…
hyperpod-cluster-debugger
Diagnose and remediate cluster-wide HyperPod (EKS or Slurm) problems — creation / deployment failures (CloudFormation, EFA health check, lifecycle scripts, capacity), EKS access, node replacement, CloudFormation nested-stack errors, post-maintenance rollback state, dangling nodes, autoscaler conflicts. Includes…
hyperpod-nccl
Diagnose NCCL failures and adjacent training-pod failures on HyperPod GPU clusters (EKS or Slurm) — training hangs, AllReduce / collective-op timeouts, EFA or libfabric errors, rendezvous failures, EFA TCP fallback, /dev/shm or memlock issues, NCCL version mismatch across pods, container OOM / exit-137 / OOMKilled…
hyperpod-issue-report
Generate comprehensive issue reports from HyperPod clusters (EKS and Slurm) by collecting diagnostic logs and configurations for troubleshooting and AWS Support cases. Use when users need to collect diagnostics from HyperPod cluster nodes, generate issue reports for AWS Support, investigate node failures or…
agentcore-investigation
Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session/trace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.