Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add UnitOneAI/SecuritySkills --skill aws-reviewgit clone --depth 1 https://github.com/UnitOneAI/SecuritySkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/unitoneai/securityskills/aws-review)<a href="https://agentmods.dev/skills/unitoneai/securityskills/aws-review"><img src="https://agentmods.dev/badge/skills/unitoneai/securityskills/aws-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.02541 |
| Opus 5 | $0.00042 | $0.01270 |
| Sonnet 5 | $0.00017 | $0.00508 |
| Haiku 4.5 | $0.00008 | $0.00254 |
Grade B, and why
aws-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential filesmediumPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
**/.aws/credentials Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 245 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AWS Security Posture Review
Overview
This skill performs a structured security assessment of AWS environments against the CIS Amazon Web Services Foundations Benchmark v3.0.0. The benchmark is organized into five sections covering identity management, storage, logging, monitoring, and networking. Each recommendation is evaluated by inspecting infrastructure-as-code definitions (Terraform, CloudFormation, CDK), AWS CLI output, or configuration files available in the repository.
The CIS AWS Foundations Benchmark v3.0.0 contains 62 recommendations across five domains. This skill evaluates each applicable control against the codebase and produces a findings report with CIS recommendation IDs, severity ratings, and actionable remediation steps.
When to Use
If a target is provided via arguments, focus the review on: $ARGUMENTS
- Reviewing AWS infrastructure-as-code before deployment
- Assessing an existing AWS environment's security posture against CIS benchmarks
- Preparing for a CIS benchmark audit or compliance assessment
- Evaluating IAM policies, S3 bucket configurations, CloudTrail settings, VPC security groups, or RDS encryption configurations
- Onboarding a new AWS account into a security program
Context
The CIS Amazon Web Services Foundations Benchmark v3.0.0 is a consensus-driven security configuration guide developed by the Center for Internet Security. It provides prescriptive guidance for configuring AWS accounts to a hardened baseline. Organizations use it as the foundation for AWS security assessments, compliance programs (PCI DSS, HIPAA, SOC 2), and continuous monitoring.
Prerequisites
- Access to AWS infrastructure-as-code files (Terraform
.tf, CloudFormation.yaml/.json, CDK source) - AWS CLI output or configuration exports (if reviewing a live environment)
- IAM policy documents (JSON)
- S3 bucket policies and ACL configurations
- VPC, security group, and NACL definitions
- CloudTrail and CloudWatch configuration files
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 245 lines · 83 tokens per session scan B 30a15d1c492f
aws-review is a skill published in the GitHub repository UnitOneAI/SecuritySkills (60 stars, last pushed 2mo ago), licensed MIT. It adds 83 tokens to every session and 2,541 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cis-aws-foundations-6.5
Ensure the default security group of every VPC restricts all traffic.
cis-aws-foundations-2.1.3
Ensure Organizations management account is not used for workloads.
cis-aws-foundations-2.2
Maintain current AWS account contact details.
cis-aws-foundations-4.4
Ensure that server access logging is enabled on the CloudTrail S3 bucket.
cis-aws-foundations-6.1.2
Ensure CIFS access is restricted to trusted networks to prevent unauthorized access.
cis-aws-foundations-2.4
Ensure no 'root' user account access key exists.