Automated Security Response on AWS skill
A skill with Claude Code, Codex and Kiro adapters that writes, tests and deploys remediations for AWS Automated Security Response.
- 488 ★ on the repository
- Last commit
Broad access
Why this level
- The agent creates and deploys AWS resources with the user's credentials and the account guard is minimal and gives no isolation.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/automated-security-response-on-awsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent creates and deploys AWS resources with the user's credentials and the account guard is minimal and gives no isolation.
This is third-party code. Review the repository files before installing.
What it does
Automated Security Response on AWS (ASR) is an AWS solution that runs automatic remediation for Security Hub findings. The `ai-assets/` directory holds a shared `asr-remediation-authoring` skill and adapters for Claude Code (the `asr-remediation-author` agent and `/remediation-author` command), Kiro and Codex CLI. The skill covers two workflows: a custom runbook in an existing ASR environment and a built-in remediation in the solution source. The agent writes a runbook, validates it, deploys it to a non-production AWS account and verifies the result. Before each write it calls STS `GetCallerIdentity` and checks the account ID. A deployed ASR MCP server is optional: the AWS CLI works without it.
Who it is for. Cloud security engineers adding their own Security Hub remediations to ASR who want an agent to produce a draft and checks.
Good fit when
- A Security Hub finding needs a custom runbook that the built-ins lack.
- A built-in remediation is contributed to the ASR source with checks to a pattern.
- A runbook is deployed to a test account to confirm the fix triggers.
- An agent is connected to a deployed ASR MCP server through AgentCore Gateway.
Not a fit when
- The account is production: an account ID and `prod` substring check is not isolation.
- You need remediations outside ASR and Security Hub.
- The environment lacks Python 3.11 and the `boto3` and `PyYAML` packages for the skill's scripts.
Example request
Write a custom ASR runbook for a Security Hub finding, validate it and deploy it to the test account.Limitations
The skill creates AWS resources, so run it only in an account you have separately confirmed as non-production: the `account_guard.py` check compares the account ID and looks for `prod` and `prd` in the ARN but does not consult AWS Organizations. You need Python 3.11 or newer, `boto3`, `PyYAML` and AWS credentials. The Kiro adapter requires Kiro CLI 3.0 or newer. There is no install package: files are copied from a cloned repository.
How to disable. Delete the copied skill, agent and command from `.claude/` (or the Codex and Kiro folders) and remove runbooks and resources created in the test account with AWS tools.
FAQ
Is a deployed ASR MCP server required?
No. The local workflow runs with the AWS CLI or any AWS MCP server already attached to the agent. The ASR MCP server is optional.
How do I invoke the skill in Claude Code?
With `/remediation-author <request>`, the `asr-remediation-author` agent, or a plain request to use the `asr-remediation-authoring` skill.
Which agents are supported?
Claude Code, Codex CLI and Kiro (CLI 3.0 and newer). `ai-assets/` has an adapter for each.
What does the account guard do?
Before writing, the skill calls STS `GetCallerIdentity`, checks the account ID matches the one named and looks for `prod` or `prd` in the ARN. It guards against typos and is not isolation.
How do the two workflows differ?
A custom runbook is deployed into a running ASR environment, while a built-in remediation is added to the solution source. Naming and deployment rules differ.
Discussion
No questions or reviews yet.
Related
SkillsMCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence
The CLI searches public profiles by username so agents can gather links for a person’s or brand’s online presence review.
Nine skills that let an agent run Strix pentests, fix validated findings and add security scanning to CI
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
A skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools
Maigret searches public accounts by username, extracts profile information and compiles findings into investigation reports.
README in short
`ai-assets/` holds the shared skill, adapters for Claude Code, Kiro and Codex, and a standalone runbook-generation prompt. Install is copying files from the repository root.