How to use the AWS Context Discovery agent skill

What is an agent skill, and what does this one make the agent do?

An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a task matches the skill's description. This skill's description tells the agent to run it at the start of any AWS task, such as deploying to SageMaker, creating resources, calling AWS APIs, or any work that touches an AWS account.

Once active, the agent discovers four things: the active profile, the region, the account ID and the caller identity. It reports them back in a line or two, and it warns you if you are signed in through SSO, because SSO principals usually cannot create IAM roles directly.

• Active profile: the AWS_PROFILE environment variable, otherwise default, unless you name a profile in your prompt.
• Region: taken from the first available source in this order: a region you named in the conversation, AWS_REGION, AWS_DEFAULT_REGION, the region field on the active profile, and only then a question to you.
• Credentials, account ID and caller ARN, checked with aws sts get-caller-identity.
• SSO detection: if the ARN shows an AWSReservedSSO role, the agent flags that IAM role creation may fail.

Install the skill from the ZIP or the Claude apps

Download the ZIP for hf-cloud-aws-context-discovery from this page. The skill ships as a single file, SKILL.md, inside the package.

For Claude Code, unzip the folder into ~/.claude/skills/ to make it available everywhere on your machine. To limit it to one project, unzip it into that project's .claude/skills/ folder instead.

In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

• Personal (all projects): ~/.claude/skills/
• Single project: .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills

Check that your AWS setup is ready

The skill only reads what already exists on your machine. It needs the AWS CLI installed and on your PATH, and a local configuration in ~/.aws/config (and optionally ~/.aws/credentials) with valid credentials, such as an SSO login or access keys.

If you have not signed in yet, do that with your normal AWS workflow first. The skill does not create credentials or sign you in.

• AWS CLI installed and available on the PATH
• Profile and region defined in ~/.aws/config, if you use them
• Valid credentials, for example an active SSO session or access keys

How do you trigger the skill with natural requests?

You usually do not need to name the skill. The description tells the agent to use it when you mention deploying, your AWS account, or a profile, and before any AWS CLI or SDK call. Plain requests are enough.

If you want to be certain, say so in the prompt and name the profile or region you want. A region you name in the conversation takes priority over every other source.

• "Deploy this model to SageMaker using my AWS account."
• "Use my profile for this, the one called work-sso."
• "Create an endpoint in whatever region my config uses."
• "Check which AWS account you're about to deploy to."

What does the agent report back?

The report is meant to be short: one or two lines naming the profile, region and account, plus a note about SSO if it applies. The skill tells the agent not to ask you to confirm a region it read from your config, because your configuration is the confirmation.

If something is wrong, such as expired credentials, a profile that does not exist or no region set anywhere, the agent should stop and show the specific error before continuing.

• Example: working with profile my-profile in eu-west-1, account 123456789012.
• Example: you are authenticated via SSO, so an existing IAM role will be needed instead of a new one.
• Stops on: invalid credentials, a missing named profile, or no region found.

What are the safety notes about scripts and network use?

This skill runs scripts and uses the network. Its instructions have the agent run aws sts get-caller-identity, which contacts AWS, and aws configure list, which reads your effective settings. Both commands are read-only in the sense that the skill's own text describes them as reads of configuration and identity, and it says the config files are plain INI files that it reads without writing.

Do not install it on shared or sensitive machines where you do not want an agent running identity checks against your account. Check the SKILL.md file yourself before installing if you need to review what it will run.

• Runs aws sts get-caller-identity and aws configure list.
• Reads ~/.aws/config and ~/.aws/credentials as plain files; the skill describes this as read-only.
• Uses network access because the identity check calls AWS.

Tips for getting the most from it

Set your profile and region in ~/.aws/config before you start. The fewer open questions the agent has, the fewer prompts you will see.

If deployments keep failing on permissions, check whether you are on an SSO login. The skill is designed to surface that early, and an existing SageMaker execution role may be the answer rather than a new one.

• Use AWS_PROFILE or AWS_REGION in your shell if you switch accounts often.
• Name the profile in your prompt when you have several.
• Ask your AWS administrator for an execution role if SSO blocks role creation.