Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add seandkendall/kiro-config --skill cognito-email-migrationgit clone --depth 1 https://github.com/seandkendall/kiro-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seandkendall/kiro-config/cognito-email-migration)<a href="https://agentmods.dev/skills/seandkendall/kiro-config/cognito-email-migration"><img src="https://agentmods.dev/badge/skills/seandkendall/kiro-config/cognito-email-migration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seandkendall/kiro-config/cognito-email-migration"><img src="https://agentmods.dev/badge/skills/seandkendall/kiro-config/cognito-email-migration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.02113 |
| Opus 5.5 | $0.00023 | $0.00845 |
| Sonnet 5.5 | $0.00011 | $0.00423 |
| Haiku 4.5 | $0.00006 | $0.00211 |
Grade A, and why
cognito-email-migration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cognito Email Migration
Step-by-step runbook for replacing the default Cognito email sender on an existing User Pool with a custom CustomEmailSender Lambda trigger. For NEW apps, just include the trigger from day one — this runbook is for existing pools that already have users.
Pre-flight
Before starting, confirm:
- The Cognito User Pool exists and is currently using the default Cognito email service (or SES with a non-templated
from_email_addressthat you want to upgrade) - You have CDK deployment access to the stack that owns the User Pool
- The
From:domain you'll send from is verified in SES (with SPF + DKIM + DMARC published peremail-standards.md) - You have a non-production environment (dev / staging) that mirrors production — DO NOT migrate prod first
- You've reviewed
email-standards.mdandemail-template-rendering.md
Important Caveat
Once CustomEmailSender is enabled on a User Pool, ALL Cognito-initiated emails go through your Lambda. There is no "fallback to default Cognito" if the Lambda fails. A Lambda timeout, KMS-decrypt failure, or SES send error means the email never arrives, which means new sign-ups can't verify and existing users can't reset passwords.
This is a one-way door for the duration the trigger is enabled. Bake in:
- CloudWatch alarms on Lambda errors and DLQ depth
- A configured DLQ on the Lambda (so failures are recoverable, not lost)
- Synthetic monitoring (a scheduled test signup once per hour against a throwaway email)
- A documented rollback plan (remove the trigger via
cdk deploy) — see "Rollback" below
Migration Steps
1. Generate the email assets in the existing project
Copy from skills/email-template-rendering/references/:
welcome.html+welcome.txtverification.html+verification.txtpassword-reset.html+password-reset.txt
Customize the placeholders to match your brand (logo URL, primary color, accent color, mailing address). Place them in cdk-backend/lambda/functions/cognito_email/emails/.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 221 lines · 57 tokens per session scan A a7298b40e989
cognito-email-migration is a skill published in the GitHub repository seandkendall/kiro-config (8 stars, last pushed yesterday), licensed Apache-2.0. It adds 57 tokens to every session and 2,113 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-27.
Other skills, from other repositories
aws-architecture
AWS architecture decisions, serverless patterns, event-driven design, service boundaries and Well-Architected Framework. Use when designing system architecture or making infrastructure tradeoffs.
aws-api
AWS API design, implementation and integration patterns. Use when creating or modifying API Gateway endpoints, OpenAPI contracts, authentication, error handling or event integrations.
sandy-cli
Run TypeScript scripts in sandboxed microVMs or Docker containers with AWS SDK access via IMDS, through the sandy CLI. Use when investigating AWS resources, running read-only queries, or executing TypeScript automation that needs AWS credentials via shell commands.
eks-ingress-migration
Assess a live EKS cluster's NGINX/Ingress estate and plan migration to Gateway API, the AWS Load Balancer Controller (ALB Ingress), or AWS Transform (ATX). Discovers ingress controllers and routes, scores migration difficulty 0–100 with a separate re-architecture gate, and generates per-cluster reports plus…
aws-cdk
AWS CDK infrastructure development in TypeScript. Use when creating stacks, constructs, L2/L3 patterns, CDK testing, synth/deploy pipelines or organizing IaC code.
aws-lambda-typescript
AWS Lambda development with TypeScript. Use when writing Lambda handlers, bundling with esbuild, using AWS SDK v3/Powertools, strict typing or optimizing Node.js Lambda performance.