AWS Cognito Auth

This skill is a documentation/authoring helper for AWS Cognito and appears internally consistent. It will show and generate code that expects you to provide AWS credentials, environment variables (USER_POOL_ID, CLIENT_ID, USERS_TABLE, etc.), and possibly Secrets Manager entries when you deploy the generated Lambdas/clients — but the skill does not itself collect or require those secrets. Before using it: 1) do not paste long-lived AWS credentials into chat; prefer IAM roles with least privilege for admin operations and use Secrets Manager for client secrets; 2) review any generated Pre-Token-Generation or Lambda trigger code carefully — these modify tokens and can elevate claims (e.g., inject admin roles) if misused; 3) ensure token storage and refresh patterns follow the security guidance in the references (avoid localStorage, use HttpOnly cookies or platform-provided secure storage); 4) when deploying triggers, verify they run within the 5s Cognito timeout and have appropriate IAM permissions scoped to specific resources; 5) confirm you are comfortable granting whatever runtime AWS credentials are necessary to execute the code the skill generates. If you want the skill to perform live AWS actions on your behalf, ask the publisher how it expects credentials to be provided and audited; otherwise using it as a documentation/authoring aid is low-risk.