Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aws/tools-for-devops-agent --skill rds-operation-reviewgit clone --depth 1 https://github.com/aws/tools-for-devops-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aws/tools-for-devops-agent/rds-operation-review)<a href="https://agentmods.dev/skills/aws/tools-for-devops-agent/rds-operation-review"><img src="https://agentmods.dev/badge/skills/aws/tools-for-devops-agent/rds-operation-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aws/tools-for-devops-agent/rds-operation-review"><img src="https://agentmods.dev/badge/skills/aws/tools-for-devops-agent/rds-operation-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00118 | $0.04889 |
| Opus 5.5 | $0.00047 | $0.01956 |
| Sonnet 5.5 | $0.00024 | $0.00978 |
| Haiku 4.5 | $0.00012 | $0.00489 |
Grade A, and why
rds-operation-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 388 lines — stays where its author put it; the contents beside it link to each section on GitHub.
RDS / Aurora Operational Review
Conduct a comprehensive operational review of Amazon RDS instances and Amazon Aurora clusters aligned with the AWS Well-Architected Framework and the Amazon RDS and Aurora best-practices guides.
This skill uses the AWS RDS, Aurora, CloudWatch, CloudWatch Logs, EC2, and Cost
Explorer APIs only — no Kubernetes (k8s) or eks MCP tools. All data is
collected through native AWS APIs available to the DevOps Agent's primary cloud
source role.
When to Use
Activate this skill when the user asks to:
- Review, audit, or assess RDS instances or Aurora clusters
- Check RDS / Aurora best-practices compliance
- Evaluate database security, cost, reliability, performance, or backups
- Perform an RDS / Aurora operational readiness review (ORR)
- Investigate database health or configuration drift
Step 1: Identify Target Resources
Ask the user which databases to review. Accept:
- Specific instance / cluster identifiers and regions
- "all instances" / "all clusters" in specific regions
- "all RDS in all regions"
If no scope is given, default to all configured account regions.
Step 2: Discover RDS / Aurora Resources
Per region (skip empty regions):
rds.DescribeDBInstances # RDS instances + Aurora cluster member instances
rds.DescribeDBClusters # Aurora clusters (skip if user said "Provisioned only")
rds.DescribeDBClusterEndpoints # Aurora reader/writer endpoints
rds.DescribeGlobalClusters # Aurora Global Database (cross-region)
rds.DescribeDBProxies # RDS Proxy
Capture per resource:
- Engine, engineVersion, dbInstanceClass / serverlessV2 capacity
- Multi-AZ, AvailabilityZones, subnetGroup, VpcId
- AllocatedStorage, MaxAllocatedStorage, StorageType, Iops, StorageThroughput, StorageEncrypted, KmsKeyId
- BackupRetentionPeriod, PreferredBackupWindow, PreferredMaintenanceWindow, AutoMinorVersionUpgrade
- DeletionProtection, PubliclyAccessible, IAMDatabaseAuthenticationEnabled
- PerformanceInsightsEnabled, PerformanceInsightsRetentionPeriod, MonitoringInterval (Enhanced Monitoring), MonitoringRoleArn
- EnabledCloudwatchLogsExports, AssociatedRoles
- ReadReplicaSourceDBInstanceIdentifier / ReadReplicaDBInstanceIdentifiers
- Tags (
rds.ListTagsForResource— param name isResourceNameand value is the resource ARN)
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed ef3252db3ae6
- 5d ago Changed f4a33909d3ed
- 1mo ago First seen · 388 lines · 118 tokens per session scan A 2f0a372b603b
rds-operation-review is a skill published in the GitHub repository aws/tools-for-devops-agent (116 stars, last pushed yesterday), licensed Apache-2.0. It adds 118 tokens to every session and 4,889 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
prowler-compliance-review
Reviews Pull Requests that add or modify compliance frameworks. Trigger: When reviewing PRs with compliance framework changes, CIS/NIST/PCI-DSS additions, or compliance JSON files.
License & SaaS Cost Optimizer
Specialist in software licenses and SaaS entitlements in the cloud era. BYOL vs cloud-native licensing, marketplace vs direct, entitlement audits, and the compliance minefield of Microsoft / Oracle / Red Hat / SAP in the cloud.
security-review
Run a structured security review before marking a task done. Services as the single audit skill for OWASP, baseline pack, domain-pack (HR/legal/marketing/sales/real-estate/government/insurance/logistics/manufacturing/e-commerce/nonprofit), and compliance (GDPR/SOC2/HIPAA/policy packs) — subsumes the deprecated…
compliance-audit
DEPRECATED — use security-review instead (it now covers all of this — regulated flows, policy packs, domain controls). Kept as a thin alias for search (compliance/GDPR/SOC2/HIPAA) so existing ckskilllist queries still surface security-review.
domain-audit
DEPRECATED — use security-review instead (it now covers all domain-pack audits — HR, legal, marketing, sales, real-estate, government, insurance, logistics, manufacturing, e-commerce, nonprofit). Kept as a thin alias so ckskilllist for those domains still surfaces security-review.
otto-pr-review-loop
Run Polly and OCR on a PR until all findings settle.