AWS Cost Optimizer

Analyzes AWS infrastructure for cost savings. Right-sizing, Reserved Instances, Savings Plans, unused resources.

Security Scan

The skill claims to analyze AWS costs but provides no instructions, dependencies, or declared credential requirements needed to actually access AWS — this mismatch is suspicious and needs clarification before use.

Purpose & Capability

The name/description say the skill analyzes AWS infrastructure for cost savings, which normally requires AWS API access (Cost Explorer, EC2/RI/Savings Plans data, resource listings). However, the skill declares no required credentials, environment variables, binaries, or config paths — which is inconsistent with the stated purpose.

Instruction Scope

The SKILL.md is just a high-level prompt telling the agent to provide detailed output, examples, and diagrams, but it contains no runtime instructions for obtaining AWS data, requesting credentials, calling AWS APIs, or processing exported reports. Its vague, open-ended wording grants the agent broad discretion without specifying how account access should be performed or constrained.

Install Mechanism

No install spec and no code files are present (instruction-only). That is low-risk from an installation perspective because nothing is automatically downloaded or written to disk.

Credentials

For an AWS analysis tool one would expect at minimum AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (or IAM role/STS tokens) or an explicit guidance to use local AWS CLI creds. The skill requires none — either it omits critical details or expects users to share credentials ad hoc, which is a risk.

Persistence & Privilege

The skill does not request always: true and has normal invocation settings. It does not declare any system-wide persistence or modification of other skills/configs.

What to consider before installing

This skill's purpose (analyzing your AWS costs) would normally require read access to AWS APIs or exported billing data, but the SKILL.md provides no mechanism for that. Before installing or using it: (1) Ask the publisher how the skill obtains AWS data — does it use AWS credentials, a role, or do you upload exported reports? (2) Never paste root or long-lived high-privilege keys into chat; if you must provide credentials, use a least-privilege, read-only IAM user or an ephemeral STS token limited to Cost Explorer and resource-listing permissions. (3) Prefer running the analysis yourself (AWS Cost Explorer, Trusted Advisor, AWS CLI) in a sandbox account and only share sanitized outputs. (4) Request concrete runtime instructions or code showing exactly which APIs/endpoints will be called and where data will be sent; without that, treat the skill as untrusted. If the author updates the skill to declare required env vars/credentials and shows exactly how AWS access is performed (and keeps everything read-only and local), reassess — that would move this toward benign. For now, the mismatch between what it says it does and what it actually requests is a red flag.

Analyzes AWS infrastructure for cost savings. Right-sizing, Reserved Instances, Savings Plans, unused resources.

You are a specialized assistant for this task. Provide detailed, actionable output with code examples, configuration files, and architecture diagrams where relevant. Follow industry best practices and explain trade-offs when multiple approaches exist. Always consider security, scalability, and maintainability.