opencode-skills-collection 3.1.12 → 3.1.13

package/bundled-skills/aws-agentic-ai/SKILL.md

@@ -0,0 +1,141 @@
+---
+name: aws-agentic-ai
+description: AWS Bedrock AgentCore comprehensive expert for deploying and managing AI agents at scale. Use when working with any AgentCore service including Gateway, Runtime, Memory, Identity, Code Interpreter, Browser, Observability, Agent Registry, or Evaluations. Covers agent deployment, MCP...
+risk: unknown
+source: https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai
+source_repo: zxkane/aws-skills
+source_type: community
+date_added: 2026-07-01
+license: MIT
+license_source: https://github.com/zxkane/aws-skills/blob/main/LICENSE
+---
+
+# AWS Bedrock AgentCore
+## When to Use
+
+Use this skill when you need aWS Bedrock AgentCore comprehensive expert for deploying and managing AI agents at scale. Use when working with any AgentCore service including Gateway, Runtime, Memory, Identity, Code Interpreter, Browser, Observability, Agent Registry, or Evaluations. Covers agent deployment, MCP...
+
+
+AWS Bedrock AgentCore provides a complete platform for deploying and scaling AI agents with nine core services. This skill covers service selection, deployment patterns, and integration workflows using AWS CLI.
+
+**How to use this skill**: Identify the service(s) the user needs from the table below, then read the corresponding service README before responding. For cross-service patterns (credentials, security, registry integration), check the Cross-Service Resources section. Verify AWS-specific details using the MCP documentation tools.
+
+## AWS Documentation Requirement
+
+Always verify AWS facts using MCP tools before answering. Two documentation sources are available:
+- **AgentCore-specific docs** (`mcp__acdocs__*`) — bundled with this plugin, provides `search_agentcore_docs` and `fetch_agentcore_doc` for AgentCore documentation
+- **General AWS docs** (`mcp__aws-mcp__*` or `mcp__*awsdocs*__*`) — loaded via the `aws-mcp-setup` dependency for broader AWS documentation
+
+Prefer the AgentCore docs MCP for AgentCore-specific questions. If MCP tools are unavailable, guide the user through the `aws-mcp-setup` skill's setup flow.
+
+## Available Services
+
+| Service | Use For | Documentation |
+|---------|---------|---------------|
+| **Gateway** | Converting REST APIs to MCP tools | [`services/gateway/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/gateway/README.md) |
+| **Runtime** | Deploying and scaling agents | [`services/runtime/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/runtime/README.md) |
+| **Memory** | Managing conversation state | [`services/memory/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/memory/README.md) |
+| **Identity** | Credential and access management | [`services/identity/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/identity/README.md) |
+| **Code Interpreter** | Secure code execution in sandboxes | [`services/code-interpreter/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/code-interpreter/README.md) |
+| **Browser** | Web automation and scraping | [`services/browser/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/browser/README.md) |
+| **Observability** | Tracing and monitoring | [`services/observability/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/observability/README.md) |
+| **Agent Registry** | Catalog, discover, and govern agents/tools (Preview) | [`services/registry/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/registry/README.md) |
+| **Evaluations** | Automated agent quality assessment (LLM-as-a-Judge) | [`services/evaluations/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/evaluations/README.md) |
+
+## Common Workflows
+
+### Deploying a Gateway Target
+
+Read [`services/gateway/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/gateway/README.md) before implementing — Gateway setup involves deployment strategies, IAM, and auth choices that vary significantly by use case.
+
+1. Upload OpenAPI schema to S3
+2. *(API Key auth only)* Create credential provider and store API key
+3. Create gateway target linking schema (and credentials if using API key)
+4. Verify target status and test connectivity
+
+> Credential provider is only needed for API key authentication. Lambda targets use IAM roles, and MCP servers use OAuth.
+
+### Managing Credentials
+
+Read [`cross-service/credential-management.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/cross-service/credential-management.md) first — credential patterns differ across services and getting them wrong causes hard-to-debug auth failures.
+
+1. Use Identity service credential providers for all API keys
+2. Link providers to gateway targets via ARN references
+3. Rotate credentials quarterly through credential provider updates
+4. Monitor usage with CloudWatch metrics
+
+### Discovering Agents and Tools (Agent Registry)
+
+Read [`services/registry/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/registry/README.md) first — the registry has governance workflows, MCP endpoint options, and sync modes that affect how records become discoverable.
+
+1. Create a registry to catalog your organization's AI resources
+2. Register resources (MCP servers, agents, skills, custom) with descriptive metadata
+3. Submit records for approval (auto-approve for dev, manual for production)
+4. Search and discover approved resources via CLI or MCP endpoint
+
+> Agent Registry is in Preview. Available in us-east-1, us-west-2, eu-west-1, ap-northeast-1, ap-southeast-2.
+
+### Evaluating Agent Quality
+
+Read [`services/evaluations/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/evaluations/README.md) first — evaluators, scoring modes, and IAM setup vary between online monitoring and on-demand testing.
+
+1. Instrument the agent with OpenTelemetry (ADOT) for trace collection
+2. Create evaluators (use built-in like `Builtin.Helpfulness` or create custom)
+3. Set up online evaluation with sampling rate and data source
+4. Monitor scores in CloudWatch dashboards; investigate low-scoring sessions
+
+### Monitoring Agents
+
+Read [`services/observability/README.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/services/observability/README.md) for the full monitoring setup — observability configuration depends on your Runtime protocol and framework choice.
+
+1. Enable observability for agents
+2. Configure CloudWatch dashboards for metrics
+3. Set up alarms for error rates and latency
+4. Use X-Ray for distributed tracing
+
+## Deep-Dive References
+
+Each service README (linked in the table above) contains sub-links to getting-started guides, troubleshooting, and advanced topics. Start with the service README and follow pointers from there.
+
+### Advanced Runtime & OAuth References
+
+Deep-dive reference documentation for Runtime internals, deployment, OAuth integration, and communication protocols. Read these when building production Runtime deployments or configuring OAuth authentication:
+
+- **OAuth Integration**: [`references/agentcore-oauth-integration.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/references/agentcore-oauth-integration.md) - Three-layer OAuth architecture (Inbound JWT, Outbound Credential Provider, Gateway OAuth), Cognito configuration, supported IdPs, end-to-end CDK examples
+- **Runtime Core Mechanisms**: [`references/agentcore-runtime-core.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/references/agentcore-runtime-core.md) - Container contract, MicroVM Session model, Agent lifecycle (per-request vs per-session), tool integration (MCP/HTTP), startup flow
+- **Runtime Deployment & Operations**: [`references/agentcore-runtime-deploy.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/references/agentcore-runtime-deploy.md) - CDK deployment (L1/L2 constructs), multi-Runtime architecture, security model, observability (OTel/CloudWatch), BedrockAgentCoreApp vs FastAPI comparison
+- **Runtime Protocol Reference**: [`references/agentcore-runtime-protocols.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/references/agentcore-runtime-protocols.md) - HTTP, MCP, A2A, AG-UI protocol specifications with container contracts, endpoint specs, and selection guide
+
+### Runnable Script Templates
+
+Production-ready templates in [`scripts/`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/scripts/) for common deployment patterns:
+
+| Script | Protocol | Description |
+|--------|----------|-------------|
+| [`Dockerfile.runtime-template`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/scripts/Dockerfile.runtime-template) | — | ARM64 multi-stage Docker build for AgentCore Runtime |
+| [`runtime-fastapi-template.py`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/scripts/runtime-fastapi-template.py) | HTTP | FastAPI Runtime with SSE streaming and MCPClient |
+| [`mcp-server-template.py`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/scripts/mcp-server-template.py) | MCP | MCP Server with Streamable HTTP transport |
+| [`a2a-server-template.py`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/scripts/a2a-server-template.py) | A2A | A2A Server with Agent Card discovery |
+| [`agui-server-template.py`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/scripts/agui-server-template.py) | AG-UI | AG-UI Server with standard AG-UI event stream |
+| [`gateway-custom-resource-lambda.py`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/scripts/gateway-custom-resource-lambda.py) | — | CDK Custom Resource Lambda for Gateway lifecycle |
+
+## Cross-Service Resources
+
+For patterns and best practices that span multiple AgentCore services:
+
+- **Credential Management**: [`cross-service/credential-management.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/cross-service/credential-management.md) - Unified credential patterns, security practices, rotation procedures
+- **Registry Integration**: [`cross-service/registry-integration.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/cross-service/registry-integration.md) - Cross-service patterns with Gateway, Identity, Runtime
+- **Security & Resource Policies**: [`cross-service/security-resource-policies.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/cross-service/security-resource-policies.md) - Resource-based policies, cross-account access, VPC/IP restrictions
+- **Agent Deployment with S3 Files**: [`cross-service/agent-persistence-patterns.md`](https://github.com/zxkane/aws-skills/tree/main/plugins/aws-agentic-ai/skills/aws-agentic-ai/cross-service/agent-persistence-patterns.md) - Deploy Strands Agents, OpenClaw, Claude Agent SDK on AgentCore with S3 Files and Session Storage
+
+## Additional Resources
+
+- **AWS Documentation**: [Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/what-is-bedrock-agentcore.html)
+- **API Reference**: [Bedrock AgentCore Control Plane API](https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/)
+- **AWS CLI Reference**: [bedrock-agentcore-control commands](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/bedrock-agentcore-control/index.html)
+
+## Limitations
+
+- Use this skill only when the task clearly matches its upstream source and local project context.
+- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
+- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.

package/bundled-skills/aws-cdk-development/SKILL.md

@@ -0,0 +1,275 @@
+---
+name: aws-cdk-development
+description: AWS Cloud Development Kit (CDK) expert for building cloud infrastructure with TypeScript/Python. Use when creating CDK stacks, defining CDK constructs, implementing infrastructure as code, or when the user mentions CDK, CloudFormation, IaC, cdk synth, cdk deploy, or wants to define AWS...
+risk: unknown
+source: https://github.com/zxkane/aws-skills/tree/main/plugins/aws-iac/skills/aws-cdk-development
+source_repo: zxkane/aws-skills
+source_type: community
+date_added: 2026-07-01
+license: MIT
+license_source: https://github.com/zxkane/aws-skills/blob/main/LICENSE
+---
+
+# AWS CDK Development
+
+This skill provides comprehensive guidance for developing AWS infrastructure using the Cloud Development Kit (CDK), with integrated MCP servers for accessing latest AWS knowledge and CDK utilities.
+
+## AWS Documentation Requirement
+
+Always verify AWS facts using MCP tools (`mcp__aws-mcp__*` or `mcp__*awsdocs*__*`) before answering. The `aws-mcp-setup` dependency is auto-loaded — if MCP tools are unavailable, guide the user through that skill's setup flow.
+
+## CDK-Specific MCP Guidance
+
+AWS Labs replaced the dedicated CDK MCP server (`awslabs.cdk-mcp-server`) with the broader `awslabs.aws-iac-mcp-server`, which covers CDK alongside CloudFormation and other AWS infrastructure-as-code workflows.
+
+For CDK construct lookups, best-practice recommendations, and pattern guidance, install `awslabs.aws-iac-mcp-server`. It ships in the `deploy-on-aws` plugin from `awslabs/agent-plugins`, or can be registered directly with `claude mcp add aws-iac uvx awslabs.aws-iac-mcp-server@latest`.
+
+**When to reach for it**:
+- CDK construct recommendations and API lookups
+- CDK and CloudFormation best-practice patterns
+- Validation of synthesized templates
+- Cross-resource configuration guidance
+
+## When to Use This Skill
+
+Use this skill when:
+- Creating new CDK stacks or constructs
+- Refactoring existing CDK infrastructure
+- Implementing Lambda functions within CDK
+- Following AWS CDK best practices
+- Validating CDK stack configurations before deployment
+- Verifying AWS service capabilities and regional availability
+
+## Core CDK Principles
+
+### Resource Naming
+
+**CRITICAL**: Do NOT explicitly specify resource names when they are optional in CDK constructs.
+
+**Why**: CDK-generated names enable:
+- **Reusable patterns**: Deploy the same construct/pattern multiple times without conflicts
+- **Parallel deployments**: Multiple stacks can deploy simultaneously in the same region
+- **Cleaner shared logic**: Patterns and shared code can be initialized multiple times without name collision
+- **Stack isolation**: Each stack gets uniquely identified resources automatically
+
+**Pattern**: Let CDK generate unique names automatically using CloudFormation's naming mechanism.
+
+```typescript
+// ❌ BAD - Explicit naming prevents reusability and parallel deployments
+new lambda.Function(this, 'MyFunction', {
+  functionName: 'my-lambda',  // Avoid this
+  // ...
+});
+
+// ✅ GOOD - Let CDK generate unique names
+new lambda.Function(this, 'MyFunction', {
+  // No functionName specified - CDK generates: StackName-MyFunctionXXXXXX
+  // ...
+});
+```
+
+**Security Note**: For different environments (dev, staging, prod), follow AWS Security Pillar best practices by using separate AWS accounts rather than relying on resource naming within a single account. Account-level isolation provides stronger security boundaries.
+
+### Lambda Function Development
+
+Use the appropriate Lambda construct based on runtime:
+
+**TypeScript/JavaScript**: Use `@aws-cdk/aws-lambda-nodejs`
+```typescript
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+
+new NodejsFunction(this, 'MyFunction', {
+  entry: 'lambda/handler.ts',
+  handler: 'handler',
+  // Automatically handles bundling, dependencies, and transpilation
+});
+```
+
+**Python**: Use `@aws-cdk/aws-lambda-python`
+```typescript
+import { PythonFunction } from '@aws-cdk/aws-lambda-python-alpha';
+
+new PythonFunction(this, 'MyFunction', {
+  entry: 'lambda',
+  index: 'handler.py',
+  handler: 'handler',
+  // Automatically handles dependencies and packaging
+});
+```
+
+**Benefits**:
+- Automatic bundling and dependency management
+- Transpilation handled automatically
+- No manual packaging required
+- Consistent deployment patterns
+
+### Pre-Deployment Validation
+
+Use a **multi-layer validation strategy** for comprehensive CDK quality checks:
+
+#### Layer 1: Real-Time IDE Feedback (Recommended)
+
+**For TypeScript/JavaScript projects**:
+
+Install [cdk-nag](https://github.com/cdklabs/cdk-nag) for synthesis-time validation:
+```bash
+npm install --save-dev cdk-nag
+```
+
+Add to your CDK app:
+```typescript
+import { Aspects } from 'aws-cdk-lib';
+import { AwsSolutionsChecks } from 'cdk-nag';
+
+const app = new App();
+Aspects.of(app).add(new AwsSolutionsChecks());
+```
+
+**Optional - VS Code users**: Install [CDK NAG Validator extension](https://marketplace.visualstudio.com/items?itemName=alphacrack.cdk-nag-validator) for faster feedback on file save.
+
+**For Python/Java/C#/Go projects**: cdk-nag is available in all CDK languages and provides the same synthesis-time validation.
+
+#### Layer 2: Synthesis-Time Validation (Required)
+
+1. **Synthesis with cdk-nag**: Validate stack with comprehensive rules
+   ```bash
+   cdk synth  # cdk-nag runs automatically via Aspects
+   ```
+
+2. **Suppress legitimate exceptions** with documented reasons:
+   ```typescript
+   import { NagSuppressions } from 'cdk-nag';
+
+   // Document WHY the exception is needed
+   NagSuppressions.addResourceSuppressions(resource, [
+     {
+       id: 'AwsSolutions-L1',
+       reason: 'Lambda@Edge requires specific runtime for CloudFront compatibility'
+     }
+   ]);
+   ```
+
+#### Layer 3: Pre-Commit Safety Net
+
+1. **Build**: Ensure compilation succeeds
+   ```bash
+   npm run build  # or language-specific build command
+   ```
+
+2. **Tests**: Run unit and integration tests
+   ```bash
+   npm test  # or pytest, mvn test, etc.
+   ```
+
+3. **Validation Script**: Meta-level checks
+   ```bash
+   ./scripts/validate-stack.sh
+   ```
+
+The validation script now focuses on:
+- Language detection
+- Template size and resource count analysis
+- Synthesis success verification
+- (Note: Detailed anti-pattern checks are handled by cdk-nag)
+
+## Workflow Guidelines
+
+### Development Workflow
+
+1. **Design**: Plan infrastructure resources and relationships
+2. **Verify AWS Services**: Use AWS Documentation MCP to confirm service availability and features
+   - Check regional availability for all required services
+   - Verify service limits and quotas
+   - Confirm latest API specifications
+3. **Implement**: Write CDK constructs following best practices
+   - Use CDK MCP server for construct recommendations
+   - Reference CDK best practices via MCP tools
+4. **Validate**: Run pre-deployment checks (see above)
+5. **Synthesize**: Generate CloudFormation templates
+6. **Review**: Examine synthesized templates for correctness
+7. **Deploy**: Deploy to target environment
+8. **Verify**: Confirm resources are created correctly
+
+### Stack Organization
+
+- Use nested stacks for complex applications
+- Separate concerns into logical construct boundaries
+- Export values that other stacks may need
+- Use CDK context for environment-specific configuration
+
+### Testing Strategy
+
+- Unit test individual constructs
+- Integration test stack synthesis
+- Snapshot test CloudFormation templates
+- Validate resource properties and relationships
+
+## Using MCP Servers Effectively
+
+### When to Use AWS Documentation MCP
+
+**Always verify before implementing**:
+- New AWS service features or configurations
+- Service availability in target regions
+- API parameter specifications
+- Service limits and quotas
+- Security best practices for AWS services
+
+**Example scenarios**:
+- "Check if Lambda supports Python 3.13 runtime"
+- "Verify DynamoDB is available in eu-south-2"
+- "What are the current Lambda timeout limits?"
+- "Get latest S3 encryption options"
+
+### When to Use CDK MCP Server
+
+**Leverage for CDK-specific guidance**:
+- CDK construct selection and usage
+- CDK API parameter options
+- CDK best practice patterns
+- Construct property configurations
+- CDK-specific optimizations
+
+**Example scenarios**:
+- "What's the recommended CDK construct for API Gateway REST API?"
+- "How to configure NodejsFunction bundling options?"
+- "Best practices for CDK stack organization"
+- "CDK construct for DynamoDB with auto-scaling"
+
+### MCP Usage Best Practices
+
+1. **Verify First**: Always check AWS Documentation MCP before implementing new features
+2. **Regional Validation**: Check service availability in target deployment regions
+3. **CDK Guidance**: Use CDK MCP for construct-specific recommendations
+4. **Stay Current**: MCP servers provide latest information beyond knowledge cutoff
+5. **Combine Sources**: Use both skill patterns and MCP servers for comprehensive guidance
+
+## CDK Patterns Reference
+
+For detailed CDK patterns, anti-patterns, and architectural guidance, refer to the comprehensive reference:
+
+**File**: `references/cdk-patterns.md`
+
+This reference includes:
+- Common CDK patterns and their use cases
+- Anti-patterns to avoid
+- Security best practices
+- Cost optimization strategies
+- Performance considerations
+
+## Additional Resources
+
+- **Validation Script**: `scripts/validate-stack.sh` - Pre-deployment validation
+- **CDK Patterns**: `references/cdk-patterns.md` - Detailed pattern library
+- **AWS Documentation MCP**: Integrated for latest AWS information
+- **CDK MCP Server**: Integrated for CDK-specific guidance
+
+## GitHub Actions Integration
+
+When GitHub Actions workflow files exist in the repository, ensure all checks defined in `.github/workflows/` pass before committing. This prevents CI/CD failures and maintains code quality standards.
+
+## Limitations
+
+- Use this skill only when the task clearly matches its upstream source and local project context.
+- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
+- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.