awslabs/agent-plugins is a collection of plugins, skills, instructions, an MCP server, a hook, and a setting that guide AI coding agents in architecting, deploying, and operating software on Amazon Web Services. It is for developers using coding agents such as Claude Code, Codex, and Cursor with AWS projects. The catalogue entries are the repository's own agent workflows and supporting components.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/awslabs/agent-pluginsnpx agentmods add skills/awslabs/agent-plugins/aws-architecture-diagramWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/awslabs/agent-plugins/aws-architecture-diagram)<a href="https://agentmods.dev/skills/awslabs/agent-plugins/aws-architecture-diagram"><img src="https://agentmods.dev/badge/skills/awslabs/agent-plugins/aws-architecture-diagram/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/awslabs/agent-plugins/aws-architecture-diagram"><img src="https://agentmods.dev/badge/skills/awslabs/agent-plugins/aws-architecture-diagram.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 98 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00110 | $0.03724 |
| Opus 5 | $0.00055 | $0.01862 |
| Sonnet 5 | $0.00022 | $0.00745 |
| Haiku 4.5 | $0.00011 | $0.00372 |
Grade A, and why
aws-architecture-diagram scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 240 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an AWS architecture diagram generator that produces draw.io XML files with official AWS4 icons. The diagrams you produce MUST match the style of official AWS Reference Architecture diagrams — professional title and subtitle, teal numbered step badges with a right sidebar legend, 48x48 service icons inside colored category containers, clean Helvetica typography, and clear data flow.
Workflow
Step 1: Determine Mode
Mode A — Codebase Analysis: If the user says "analyze", "scan", "from code", or references their existing project:
- Scan for infrastructure files: CloudFormation (
AWSTemplateFormatVersion,AWS::*), CDK (cdk.json, construct definitions), Terraform (resource "aws_*") - Extract services, relationships, VPC structure, and data flow direction
- If NO AWS infrastructure files found, scan for non-AWS technologies: Dockerfiles, database configs, API integrations, ML frameworks (pytorch, tensorflow, coreml), message brokers (kafka, rabbitmq). Map discovered technologies using
references/general-icons.md - For MIXED architectures (AWS + non-AWS): use AWS icons for AWS services, general icons for non-AWS. Same layout rules apply.
- Confirm discovered architecture with user before generating
- Ask which diagram type best represents the architecture
Mode B — Brainstorming: If the user describes an architecture or says "brainstorm"/"design"/"from scratch":
- Ask 3-5 focused questions (purpose, services, scale, security, traffic pattern)
- Propose the architecture with service recommendations and data flow
- Iterate if needed, then generate
Step 2: Styling Selections
These are independent of Mode and apply after mode selection:
- Sketch mode: Activated ONLY if user says "sketch", "hand-drawn", or "sketchy". Default: OFF (Helvetica, no sketch attributes). See Sketch Mode in Style Rules below.
- Legend panel: Activated by default for 7+ services or multiple branching paths. Disabled ONLY if user says "no legend", "without legend", "skip steps", or "no sidebar".
- Export format: Check for format keywords (png, svg, pdf). Default:
.drawioonly.
What ships with it
20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/aws4-shapes-resources.md 15 KB
- references/aws4-shapes-services.md 8.9 KB
- references/cli-export.md 1.9 KB
- references/diagram-templates-advanced.md 1.5 KB
- references/diagram-templates-basic.md 2.5 KB
- references/example-agentcore.drawio 28 KB
- references/example-complex-platform.drawio 45 KB
- references/example-event-driven.drawio 43 KB
- references/example-microservices.drawio 46 KB
- references/example-multi-region-active-active.drawio 30 KB
- references/example-saas-backend.drawio 53 KB
- references/example-sketch.drawio 33 KB
- references/general-icons.md 5.1 KB
- references/group-styles.md 6.6 KB
- references/layout-guidelines.md 6.3 KB
- references/post-processing.md 982 B
- references/style-guide.md 6.2 KB
- references/xml-rules.md 5.1 KB
- references/xml-templates-examples.md 2.8 KB
- references/xml-templates-structure.md 6.4 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 240 lines · 110 tokens per session scan A 14a780426194
aws-architecture-diagram is a skill published in the GitHub repository awslabs/agent-plugins (890 stars, last pushed 4d ago), licensed Apache-2.0. It adds 110 tokens to every session and 3,724 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
aws-architecture-diagram
AWS architecture diagrams — generate visual network topology diagrams from live AWS infrastructure. Use when drawing AWS network diagrams, visualizing VPCs, mapping Transit Gateway topology, or generating architecture documentation.
drawio-aws
Use when the user asks for an AWS architecture diagram — VPC/networking, event-driven, landing zone, multi-AZ, serverless pipeline, or any diagram built with AWS service icons. Builds with the declarative layout engine using ground-truth mxgraph.aws4 stencils, validates (stencils/colors/nesting/geometry), runs a…
aws-drawio-architecture-diagrams
Creates professional AWS architecture diagrams in draw.io XML format (.drawio files) using official AWS Architecture Icons (aws4 library). Use when the user asks for AWS diagrams, VPC layouts, multi-tier architectures, serverless designs, network topology, or draw.io exports involving Lambda, EC2, RDS, or other AWS…
eks-upgrade-readiness
Use this skill when a user asks to assess, plan, or validate an Amazon EKS cluster upgrade. Activate on requests mentioning "EKS upgrade", "Kubernetes version upgrade", "upgrade readiness", "upgrade plan", "pre-upgrade check", "version skew", "deprecated API", "addon compatibility", "node group upgrade", "control…
cis-aws-foundations-3.2.3
Ensure that RDS instances are not publicly accessible.
msk-operations
Amazon MSK Provisioned operations, troubleshooting, and health assessment for Standard and Express brokers. Use whenever the user mentions Amazon MSK, MSK Provisioned, MSK Standard/Express brokers, Apache Kafka on AWS, kafka. / express. instance types, or the AWS/Kafka CloudWatch namespace. Covers MSK performance…