AWS Context Discovery
Resolve the active AWS environment before any account operation.
The skill mainly reads local AWS configuration and calls STS for identity discovery; no malware or credential theft is evident. However, it lacks explicit user confirmation, disclosure of sensitive-data exposure boundaries, permission isolation, and recovery controls, so points are deducted.
Profile and region precedence, stop conditions, and reporting format are reasonably clear. However, the command examples are inconsistent about passing profile and region, and edge cases such as credential-chain failures, missing regions, and environment/config conflicts lack controlled diagnostics or behavior tests; the static ceiling also applies.
Triggers, target scenarios, and expected output are clear for pre-deployment AWS context discovery. Boundaries for non-fit cases, Chinese-language interaction, and mainland-China reachability of AWS CLI/STS are not documented, so points are deducted.
The documentation is readable and includes examples and relevant caveats; the repository supplies an Apache-2.0 license and CI for generated artifacts. The skill itself lacks versioning, changelog, explicit maintenance ownership, update path, dependency installation notes, and FAQs, so points are deducted.
Discovering the profile, region, account ID, caller ARN, and possible SSO status plausibly completes the core task with concise usable output. Static evidence cannot confirm end-to-end correctness, and several configuration failures still require manual handling, so the score remains limited.
The skill text and repository CI artifact checks are auditable, but the CI does not test the skill's AWS execution paths and there are no committed behavioral tests, third-party execution records, or independent reproductions; only limited credit is justified.
- The skill reads local AWS configuration and sends an identity query to AWS STS; users should confirm the data-handling requirements for the active profile and account.
- The examples using aws configure list and parameterless get-caller-identity are inconsistent with the earlier explicit profile/region resolution and may use a different effective context.
- AWS CLI installation, credential-source handling, SSO renewal, and concrete recovery steps for missing regions are not documented.
- No assurance is provided for mainland-China network reachability or Chinese-language error feedback.
What does this skill do, and when should you use it?
This skill establishes the user’s local AWS context at the beginning of AWS work. It resolves the effective profile and region, then calls AWS STS to validate credentials and retrieve the account ID and caller ARN. It classifies the caller as an IAM user, regular assumed role, or SSO assumed role. For SSO identities, it surfaces the likely limitation around creating or modifying IAM roles before later work begins.
Reads AWS_PROFILE, AWS_REGION, AWS_DEFAULT_REGION, and the active profile’s local AWS configuration; runs aws configure list to inspect effective settings; runs aws sts get-caller-identity to validate credentials and retrieve Account and Arn; classifies the caller from the ARN; and reports the profile, region, account ID, principal type, and relevant IAM limitation.
- A user says “use my AWS account” without naming an account or region, so the agent can resolve the local configuration first.
- A model is about to be deployed to SageMaker without an explicit profile or region, so the agent can identify the actual AWS target.
- An AWS CLI or SDK call is about to run, so credentials can be validated beforehand.
- A user authenticated through AWS SSO is preparing SageMaker work, so likely IAM role-creation restrictions can be flagged early.
What are this skill's strengths and limitations?
- Defines an explicit profile and region resolution order instead of guessing.
- Uses one STS call to validate credentials and obtain both the account ID and caller ARN.
- Identifies AWSReservedSSO principals early, before IAM role operations fail later.
- Requires the local AWS CLI, AWS configuration, and usable credentials.
- Requires network access to AWS STS; it stops when credentials are expired, a profile is missing, or no region is configured.
- Only discovers context; it does not deploy resources, create IAM roles, or perform subsequent AWS operations.
How do you install this skill?
Copy or symlink skills/hf-cloud-aws-context-discovery/ from the repository’s skills/ directory into a standard Codex .agents/skills location, such as .agents/skills in the repository or .agents/skills in the user directory. The README does not provide a dedicated installation command for this individual skill.
How do you use this skill?
After placing the skill where the client can discover it, invoke it in an AWS task such as “Use my AWS profile to deploy to SageMaker.” It should run before other AWS work and report a specific error if the profile, region, or credentials cannot be resolved.