@raishin/vanguard-frontier-agentic 1.0.0 → 1.2.0

package/skills/aws/aws-agentcore/references/official-sources.md

@@ -0,0 +1,67 @@
+# Official sources
+
+Use this reference when grounding current Amazon Bedrock AgentCore behavior.
+
+## Amazon Bedrock AgentCore
+
+- Get started with Amazon Bedrock AgentCore CLI  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-get-started-cli.md
+- Available interfaces for using Amazon Bedrock AgentCore  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/develop-agents.html
+- AgentCore harness overview  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness.html
+- Get started with the harness  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-get-started.html
+- Environment and Skills  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-environment.html
+- Security and access control  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-security.html
+- What is Amazon Bedrock AgentCore  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/what-is-bedrock-agentcore.html
+- Runtime getting started  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-get-started.html
+- AgentCore Memory  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory.html
+- AgentCore Gateway  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html
+- AgentCore Identity  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity.html
+- AgentCore Observability  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
+- Browser tool  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-tool.html
+- Code Interpreter  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter.html
+- AgentCore tools configuration  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-tools.html
+- Policy in AgentCore  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html
+- Create a policy  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-create-policies.html
+- Core concepts for policy  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-core-concepts.html
+- Harness operations  
+  https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-operations.html
+
+## Grounded notes from Context7
+
+- Current AWS devguide guidance says the recommended CLI install for new projects is `npm install -g @aws/agentcore`.
+- The AgentCore CLI is the Node.js command-line tool for creating, configuring, deploying, and managing agents and uses project JSON config under the `agentcore/` directory, including `agentcore.json` and `aws-targets.json`.
+- AgentCore tool configuration can include remote MCP servers, AgentCore Gateway, Browser, Code Interpreter, and inline functions.
+- For managed credential rotation and API key storage, prefer AgentCore Gateway and AgentCore Identity over raw authentication headers.
+- AgentCore Observability uses CloudWatch metrics for runtime, memory, gateway, built-in tools, and identity resources; custom runtime metrics need instrumentation such as AWS Distro for OpenTelemetry.
+- AgentCore offers two distinct paths: code-based agents and the managed harness. Current AWS docs describe the code-based agent path as generally available and the config-based harness path as preview.
+- Skills referenced with `--skill-path` must already exist inside the runtime container or session environment. The path reference does not upload the skill for you.
+- Gateway creation is not the end of the security model. Official policy docs show Cedar-based policy enforcement is a separate control plane you must design explicitly.
+- Harness security docs say SigV4 callers do not get per-user identity propagation into downstream tools. User-scoped token vault and on-behalf-of flows require the OAuth bearer-token path.
+- Harness overview docs note regional rollout is ongoing and the currently documented harness availability is limited; do not assume every AgentCore feature is live in every region.
+- Official harness docs describe `agentcore invoke --exec` shell access to the session environment, but installed CLI surfaces can drift. Verify the local CLI before promising that workflow.
+
+## Starter toolkit caveat
+
+- The Bedrock AgentCore Starter Toolkit repository is still useful for migration and existing Python-based workflows.
+- Based on current official AWS devguide evidence, do not present the starter toolkit as the recommended starting point for new projects when the newer `@aws/agentcore` CLI is available.
+
+## Grounding rule
+
+Docs explain service behavior. They do not prove the user's installed CLI version, active AWS account, IAM role, Region support, quotas, deployed AgentCore resources, or whether preview-only features are enabled in that account.

package/skills/aws/aws-agentcore/references/safety-checklist.md

@@ -0,0 +1,30 @@
+# Safety checklist
+
+Use before AgentCore deployment, tool exposure, Memory/Gateway changes, Identity integration, Browser/Code Interpreter enablement, or production recommendations.
+
+## Non-negotiables
+
+- Do not ask for or print AWS credentials, API keys, OAuth client secrets, access tokens, private keys, account IDs, customer data, or tenant identifiers.
+- Do not hardcode credentials into MCP headers, agent code, environment files, or reference examples.
+- Do not tell users the Python starter toolkit is the preferred new-project path when current official AWS docs recommend the npm CLI `@aws/agentcore`.
+- Prefer AgentCore Gateway and AgentCore Identity for managed credential handling where applicable.
+- Keep action/tool permissions least-privilege and scoped to the task.
+- Confirm logging, metrics, tracing, and CloudWatch visibility before production rollout.
+- Confirm whether the answer relies on code-based agent GA behavior or harness preview behavior.
+- Confirm whether the target region supports the specific AgentCore capability being recommended.
+- Require explicit approval before deployment, exposing tools, enabling browser/code execution, or changing memory persistence.
+
+## Component risks
+
+- **Runtime:** wrong entrypoint, broad execution role, public network mode, missing logs, unbounded session lifetime.
+- **Memory:** PII retention, namespace leakage, actor/session mixups, memory poisoning, untested deletion/expiry behavior.
+- **Gateway/MCP tools:** overbroad tool access, raw bearer tokens, unsafe OpenAPI targets, excessive scopes, no tool audit trail.
+- **Identity:** unmanaged secrets, unclear credential provider, missing rotation, broad OAuth scopes, assuming SigV4 preserves end-user identity when official docs say it does not.
+- **Environment/skills:** assuming `--skill-path` uploads local folders, forgetting ECR/VPC/container prerequisites, or binding nonexistent in-container paths.
+- **Policy:** creating Gateway tools without Cedar policy boundaries or clear principal/resource conditions.
+- **Browser:** browsing sensitive sites, recording exposure, egress risk, uncontrolled side effects.
+- **Code Interpreter:** data exfiltration, untrusted code, package/network risk, missing sandbox boundaries.
+
+## Evidence labels
+
+Use `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`. Documentation alone never proves the user's live AgentCore deployment.

package/skills/aws/aws-agentcore/references/workflow-and-output.md

@@ -0,0 +1,53 @@
+# Workflow and output contract
+
+Use this reference for full AgentCore implementation, deployment, or production-readiness work.
+
+## Workflow
+
+1. **Classify the path**
+   - Existing agent adaptation
+   - New project scaffold with the recommended npm CLI
+   - Import/migration from an existing Amazon Bedrock Agent
+   - Code-based agent versus config-based harness
+   - Runtime/local invoke loop
+   - Environment/skills path loading
+   - Memory integration
+   - Gateway/MCP/tool integration
+   - Identity/credential flow
+   - Observability/instrumentation
+   - Browser or Code Interpreter tool usage
+   - Policy/Cedar controls for Gateway tool access
+
+2. **Verify tooling and docs**
+   - Check installed AgentCore CLI/toolkit version when local commands will run.
+   - Check whether the user is on a code-based agent path or the harness preview path.
+   - For new projects, default to the npm CLI package `@aws/agentcore` unless the user is intentionally staying on an older Python toolkit workflow.
+   - Prefer current official docs, Context7, or configured AgentCore MCP documentation tools.
+   - If AWS docs and starter-toolkit examples disagree, prefer the newer AWS devguide wording and call out the mismatch.
+   - Treat bundled commands as examples until verified against local tooling.
+   - Confirm region support before recommending harness-specific workflows.
+
+3. **Implement minimally**
+   - Existing agents: wrap/adapt runtime entrypoint; do not scaffold over code.
+   - New projects: prefer non-interactive generation with the recommended CLI only when project creation is requested.
+   - Skills: treat `--skill-path` as a container/session filesystem reference, not a skill uploader.
+   - Memory/Gateway/Identity: create and test resources separately before wiring production flows.
+   - Gateway: pair tool onboarding with policy and identity decisions; do not stop at endpoint creation.
+   - Harness: call out preview status and identity propagation caveats if you recommend it.
+
+4. **Validate**
+   - Run local invoke/test loop.
+   - Confirm IAM role, network mode, environment variables, package dependencies, logs, metrics, tracing prerequisites, and rollback path.
+   - Confirm which commands actually exist in the installed CLI before giving automation steps.
+
+## Output contract
+
+Return:
+
+1. AgentCore component in scope
+2. Evidence level and current unknowns
+3. Minimal implementation plan
+4. Commands/code to run or verify
+5. Security caveats
+6. Rollback or cleanup path
+7. Feature maturity caveat if the answer touches preview-only harness behavior

package/skills/aws/aws-api-edge-delivery-review/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: aws-api-edge-delivery-review
+description: Review AWS API and edge delivery posture across API Gateway, CloudFront, AWS WAF, Shield, ALB, custom domains, TLS policies, authentication, authorization, throttling, quotas, caching, origin protection, logging, and abuse controls. Use when public APIs, web entry points, or edge delivery can affect security and availability.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.2"
+---
+
+# AWS API Edge Delivery Review
+
+## Purpose
+
+Act as the AWS API/edge reviewer who assumes every public endpoint without throttling, auth, WAF, origin protection, and logs is an incident waiting for traffic.
+
+## When to use
+
+Use this skill for:
+
+- API Gateway REST/HTTP/WebSocket API, CloudFront distribution, WAF web ACL, Shield, ALB ingress, or public endpoint review
+- throttling, quotas, auth/JWT/IAM/Lambda authorizer, custom domain, TLS, logging, caching, or CORS questions
+- origin access control, S3 origin protection, WAF managed rules, bot/abuse protection, or DDoS posture
+- API/edge incident involving 4xx/5xx spikes, latency, cache poisoning, blocked traffic, or unexpected cost
+
+## Lean operating rules
+
+- Prefer `AwsDocumentationMcpServer` when available via `uvx awslabs.aws-documentation-mcp-server@latest`; if `uvx` cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting recommendations.
+- [Official sources](references/official-sources.md) — use when grounding AWS service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks or control gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/aws/aws-api-edge-delivery-review/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "aws-api-edge-delivery-review",
+  "name": "AWS API Edge Delivery Review",
+  "type": "skill",
+  "provider": "aws",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review API Gateway, CloudFront, AWS WAF, Shield, ALB edge/API exposure, throttling, auth, TLS, origin protection, caching, logging, and abuse controls.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html",
+    "https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html",
+    "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html",
+    "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html"
+  ],
+  "security_notes": "Do not approve public API or edge changes without auth, throttling, TLS, logging, WAF/origin protection where appropriate, sensitive-log controls, and rollback path.",
+  "last_verified": "2026-04-29",
+  "path": "skills/aws/aws-api-edge-delivery-review",
+  "author": "github: Raishin",
+  "version": "0.1.2"
+}

package/skills/aws/aws-api-edge-delivery-review/references/official-sources.md

@@ -0,0 +1,15 @@
+# Official sources
+
+Use this reference only when you need source grounding for AWS service behavior or the detailed source list.
+
+## AWS documentation
+
+Use these as starting points, not as proof of the user's live AWS state:
+- https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html
+- https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html
+- https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+- https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html
+
+## Grounding rule
+
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, or operational state. Prefer live AWS MCP/CLI evidence or sanitized user-provided evidence for current-state claims.

package/skills/aws/aws-api-edge-delivery-review/references/safety-checklist.md

@@ -0,0 +1,25 @@
+# Safety checklist
+
+Use this reference before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting recommendations.
+
+## Non-negotiables
+
+- Never ask users to paste secrets, access keys, session tokens, private keys, customer identifiers, or sensitive account data into chat.
+- Prefer official AWS MCP tools when exposed by the active runtime. If no AWS MCP tool is available, use AWS CLI/read-only repository evidence or official documentation, and label the evidence level.
+- Do not invent account IDs, ARNs, Regions, resource names, quotas, prices, or live configuration state.
+- Require explicit user approval before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting actions.
+- Use Context7 or official AWS documentation for current service behavior when the answer depends on AWS service details.
+- Keep remediation least-privilege, reversible, and scoped to the requested workload or account boundary.
+
+## Stress checks
+
+- What can expose data?
+- What can escalate privilege?
+- What can break production or block rollback?
+- What can create unbounded cost?
+- What compliance or audit evidence is missing?
+- What rollback or validation path is unproven?
+
+## Evidence labels
+
+Use `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`. Documentation alone never proves the user's live AWS state.

package/skills/aws/aws-api-edge-delivery-review/references/workflow-and-output.md

@@ -0,0 +1,58 @@
+# Workflow and output contract
+
+Use this reference only when performing the full review, implementation guidance, incident triage, or production-readiness pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+- Public entry points, domains, TLS, DNS, authN/authZ, origin type, cache behavior, and routing path
+- API Gateway throttling/quotas/logging, CloudFront OAC/OAI, WAF rules/actions/count mode, Shield, and origin protection
+- Sensitive logging, CORS, headers, cache keys, invalidation, rate limits, bot/abuse controls, and error responses
+- Metrics, access logs, WAF logs, CloudFront logs, alarms, rollback, staged deployment, and blast radius
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload/account/Region/environment:
+   - Business criticality and owner:
+   - Data classification and compliance driver:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live AWS MCP read-only evidence if available.
+   - Otherwise inspect repository IaC/config, sanitized user evidence, or official AWS docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What can expose data?
+   - What can escalate privilege?
+   - What can break production or block rollback?
+   - What can create unbounded cost?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# AWS API Edge Delivery Review: <scope>
+## Executive verdict
+- Status: READY / READY WITH RISKS / NOT READY / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Validation
+- Commands or checks:
+- Expected result:
+## Residual risk
+- <risk or explicit none>
+```

package/skills/aws/aws-bedrock-agent-security-governor/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: aws-bedrock-agent-security-governor
+description: Review Amazon Bedrock agents, AgentCore, Guardrails, knowledge bases, action groups, memory, MCP/tool integrations, prompt-injection and prompt-leakage defenses, PII handling, encryption, logging, observability, and least-privilege IAM. Use for AWS-native GenAI and agent security posture.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.2"
+---
+
+# AWS Bedrock Agent Security Governor
+
+## Purpose
+
+Act as the Bedrock agent security governor who assumes every tool, memory store, retrieval source, and system prompt can become an attack path.
+
+## When to use
+
+Use this skill for:
+
+- Bedrock agent, AgentCore, Guardrails, knowledge base, action group, or model invocation security review
+- prompt injection, prompt leakage, memory poisoning, PII redaction, sensitive information filters, or denied topic questions
+- agent action-group Lambda/IAM permissions, data source access, KMS, logging, or observability design
+- RAG or tool-using GenAI application production readiness on AWS
+
+## Lean operating rules
+
+- Prefer `AwsDocumentationMcpServer` when available via `uvx awslabs.aws-documentation-mcp-server@latest`; if `uvx` cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting recommendations.
+- [Official sources](references/official-sources.md) — use when grounding AWS service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks or control gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/aws/aws-bedrock-agent-security-governor/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "aws-bedrock-agent-security-governor",
+  "name": "AWS Bedrock Agent Security Governor",
+  "type": "skill",
+  "provider": "aws",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Amazon Bedrock agents, AgentCore, Guardrails, knowledge bases, action groups, memory, prompt-injection defenses, PII handling, observability, and least-privilege access.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/security-best-practice-agents.html",
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html",
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html",
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-how.html"
+  ],
+  "security_notes": "Do not grant broad tool or data access to Bedrock agents. Require least privilege, prompt-injection tests, guardrail coverage, PII controls, observability, and kill-switch/rollback design.",
+  "last_verified": "2026-04-29",
+  "path": "skills/aws/aws-bedrock-agent-security-governor",
+  "author": "github: Raishin",
+  "version": "0.1.2"
+}

package/skills/aws/aws-bedrock-agent-security-governor/references/official-sources.md

@@ -0,0 +1,15 @@
+# Official sources
+
+Use this reference only when you need source grounding for AWS service behavior or the detailed source list.
+
+## AWS documentation
+
+Use these as starting points, not as proof of the user's live AWS state:
+- https://docs.aws.amazon.com/bedrock/latest/userguide/security-best-practice-agents.html
+- https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html
+- https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html
+- https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-how.html
+
+## Grounding rule
+
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, or operational state. Prefer live AWS MCP/CLI evidence or sanitized user-provided evidence for current-state claims.

package/skills/aws/aws-bedrock-agent-security-governor/references/safety-checklist.md

@@ -0,0 +1,25 @@
+# Safety checklist
+
+Use this reference before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting recommendations.
+
+## Non-negotiables
+
+- Never ask users to paste secrets, access keys, session tokens, private keys, customer identifiers, or sensitive account data into chat.
+- Prefer official AWS MCP tools when exposed by the active runtime. If no AWS MCP tool is available, use AWS CLI/read-only repository evidence or official documentation, and label the evidence level.
+- Do not invent account IDs, ARNs, Regions, resource names, quotas, prices, or live configuration state.
+- Require explicit user approval before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting actions.
+- Use Context7 or official AWS documentation for current service behavior when the answer depends on AWS service details.
+- Keep remediation least-privilege, reversible, and scoped to the requested workload or account boundary.
+
+## Stress checks
+
+- What can expose data?
+- What can escalate privilege?
+- What can break production or block rollback?
+- What can create unbounded cost?
+- What compliance or audit evidence is missing?
+- What rollback or validation path is unproven?
+
+## Evidence labels
+
+Use `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`. Documentation alone never proves the user's live AWS state.

package/skills/aws/aws-bedrock-agent-security-governor/references/workflow-and-output.md

@@ -0,0 +1,58 @@
+# Workflow and output contract
+
+Use this reference only when performing the full review, implementation guidance, incident triage, or production-readiness pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+- Agent architecture: model, prompts, orchestration, action groups, Lambda/tools, knowledge bases, memory, guardrails, and data stores
+- Threat model: prompt injection, prompt leakage, tool abuse, data exfiltration, memory poisoning, unsafe retrieval, and overbroad IAM
+- Guardrail coverage: what input/output sections are evaluated, policy types, blocked messages, tests, and cost/latency impact
+- Security evidence: IAM, KMS, logging, CloudTrail, application telemetry, PII handling, evals, and rollback/disable path
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload/account/Region/environment:
+   - Business criticality and owner:
+   - Data classification and compliance driver:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live AWS MCP read-only evidence if available.
+   - Otherwise inspect repository IaC/config, sanitized user evidence, or official AWS docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What can expose data?
+   - What can escalate privilege?
+   - What can break production or block rollback?
+   - What can create unbounded cost?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# AWS Bedrock Agent Security Governor: <scope>
+## Executive verdict
+- Status: READY / READY WITH RISKS / NOT READY / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Validation
+- Commands or checks:
+- Expected result:
+## Residual risk
+- <risk or explicit none>
+```

package/skills/aws/aws-change-impact-advisor/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: aws-change-impact-advisor
+description: Assess AWS change impact using change sets, deployment blast radius, rollback readiness, dependency mapping, risk, go/no-go context, approval context, and stakeholder communication. Prefer this for non-destructive pre-change advisory work; prefer IaC or platform-specific skills for deep implementation review.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# AWS Change Impact Advisor
+
+## Purpose
+
+Act as the AWS change impact advisor who assumes every planned change has hidden dependencies until the blast radius, rollback path, and stakeholder impact are proven.
+
+## When to use
+
+Use this skill for:
+
+- pre-change AWS risk review or go/no-go decision support
+- rollback, blast-radius, dependency, or communication planning for planned changes
+- business-facing explanation of operational impact before a deployment or infra change
+- non-destructive review of change calendars, approvals, or planned production actions
+
+## Lean operating rules
+
+- Prefer `AwsDocumentationMcpServer` when available via `uvx awslabs.aws-documentation-mcp-server@latest`; if `uvx` cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
+- This role is non-destructive by default. Prefer read-only discovery, reporting, notification, escalation, and approval-gated recommendations over direct mutation.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad access, destructive automation, unsupported production claims, weak ownership, and vague business impact.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, advisory workflow, or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before privileged, cost-changing, compliance-impacting, or production-impacting recommendations.
+- [Official sources](references/official-sources.md) — use when grounding AWS service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks, blockers, or coordination gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/aws/aws-change-impact-advisor/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "aws-change-impact-advisor",
+  "name": "AWS Change Impact Advisor",
+  "type": "skill",
+  "provider": "aws",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Assess planned AWS change impact, blast radius, rollback readiness, stakeholder communication, and non-destructive go/no-go guidance before execution.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html",
+    "https://docs.aws.amazon.com/prescriptive-guidance/latest/choosing-git-branch-approach/plan-your-change-management-strategy.html",
+    "https://docs.aws.amazon.com/systems-manager/latest/userguide/change-calendar.html",
+    "https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/design_principles.html"
+  ],
+  "security_notes": "This role is advisory only. Do not approve execution from weak evidence. Require explicit rollback, dependency, owner, and communication clarity before treating a change as low-risk.",
+  "last_verified": "2026-04-29",
+  "path": "skills/aws/aws-change-impact-advisor",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/aws/aws-change-impact-advisor/references/official-sources.md

@@ -0,0 +1,12 @@
+# Official sources
+
+Use this reference when grounding current AWS service behavior for this role.
+
+- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html
+- https://docs.aws.amazon.com/prescriptive-guidance/latest/choosing-git-branch-approach/plan-your-change-management-strategy.html
+- https://docs.aws.amazon.com/systems-manager/latest/userguide/change-calendar.html
+- https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/design_principles.html
+
+## Grounding rule
+
+Docs explain service behavior. They do not prove the user's deployed state, ownership, SLAs, budget posture, or current incident reality.

package/skills/aws/aws-change-impact-advisor/references/safety-checklist.md

@@ -0,0 +1,14 @@
+# Safety checklist
+
+Use before recommending automation, escalation, or production-affecting follow-up from AWS Change Impact Advisor.
+
+## Non-negotiables
+
+- Do not ask for or print secrets, credentials, private keys, account numbers, customer identifiers, or unsanitized operational payloads.
+- Keep this role non-destructive. Prefer read-only discovery, status reporting, notification, evidence gathering, and approval-gated recommendations.
+- Do not suppress alerts, alter workloads, or change infrastructure from this role by default.
+- Confirm ownership, priority, evidence quality, and business impact before strong recommendations.
+
+## Evidence labels
+
+Use `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.