skills.rest
dennisvink
dennisvinkCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

aws-security

Review AWS security service configurations and summarize findings using read-only CLI APIs.

Updated Sep 8, 2026
Search Tags:#security#aws#compliance#inspector#guardduty#macie#security hub
One-click install
npx skills add https://github.com/dennisvink/yolomancer --skill aws-security-dennisvink
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-security
Source: https://github.com/dennisvink/yolomancer/tree/main/skills/aws/core-skills/aws-security
Command: npx skills add https://github.com/dennisvink/yolomancer --skill aws-security-dennisvink

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Auditing AWS security posture across GuardDuty, Inspector, Security Hub, Macie, Detective, and Security Lake requires knowing dozens of APIs and correct query patterns; this Skill provides structured, read-only procedures for configuration reviews and findings summaries across all of them. ## Core Features & Use Cases - Configuration Reviews: Verify deployment completeness for GuardDuty, Inspector, Security Hub (V2/OCSF and CSPM/ASFF), Macie, Detective, Security Lake, and AWS Organizations security policies. - Findings Summaries: Produce severity distributions, attack sequence highlights, exposure findings, compliance pass/fail rates, and sensitive data detection overviews without triage or remediation. - Use Case: Ask whether GuardDuty runtime monitoring is enabled across your organization, and the Skill routes to the GuardDuty configuration procedure, checks detector features and org auto-enable settings, and returns a configuration state table. ## Quick Start Ask the assistant to summarize active GuardDuty findings by severity and attack sequences across your AWS organization.

Frequently Asked Questions about aws-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if GuardDuty is configured correctly in my AWS account?▼

Run aws guardduty list-detectors to get the detector ID, then get-detector to enumerate all features and their status. The Skill's GuardDuty configuration procedure also checks publishing destinations, malware protection plans, and organization auto-enable settings.

How do I summarize Security Hub findings across my organization?▼

Use the V2 APIs: get-finding-statistics-v2 for severity aggregation and get-findings-v2 with a class_name filter to surface Exposure findings first. Cross-account visibility requires running from a delegated administrator account.

What is the difference between Security Hub V2 and Security Hub CSPM?▼

Security Hub V2 uses OCSF format with -v2 suffixed APIs for unified findings, connectors, and exposure analysis. Security Hub CSPM uses ASFF format with unsuffixed V1 APIs for compliance standards like FSBP, CIS, PCI-DSS, and NIST.

Does this Skill modify any AWS security configurations?▼

No. All procedures use exclusively read-only APIs and explicitly prohibit any mutating calls, suppression recommendations, or remediation actions. It presents configuration state and findings summaries factually without severity judgements on configuration.

Why does the organization policy check return AccessDeniedException?▼

Organization policy APIs require a role in the Organizations management account or a delegated administrator with the delegation policy configured. If access is denied, the Skill reports policy status as not checked and continues with service-specific checks.

Can I get per-account findings detail for all member accounts?▼

Per-account enumeration only runs when you explicitly request it, since paginating all member accounts is expensive. By default the Skill uses statistics and coverage APIs like get-coverage-statistics for organization-level summaries.

Related Skills

Explore More Software Engineering Skills→
dgethingsdgethings

aws-security-audit

Inspect IAM users, roles, policies, and CloudTrail events across AWS accounts.

Community
Advanced
xalgordxalgord
954

implementing-ticketing-system-for-incidents

Automates SIEM-to-ticket incident creation, SLA tracking, and escalation in ServiceNow, Jira, or TheHive.

Community
Advanced
jason-c-devjason-c-dev
1

aws-observability-setup

Configures CloudWatch, CloudTrail, AWS Config, and Security Hub across accounts and regions.

Community
Intermediate
global-osglobal-os

vercel-connect

Manage OAuth token acquisition for Slack, GitHub, and MCP servers via Vercel Connect.

Official
Advanced