Skills assume-cloudformation-role
📦
assume-cloudformation-role
Content revision r1 Critical ⚙️ External commands📁 Filesystem access🔑 Env variables
Assume CloudFormation AWS Roles
CloudFormation work often needs short lived role credentials before stack changes can run. This skill gives Claude, Codex, and Claude Code a repeatable AWS STS workflow for preparing those credentials.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "assume-cloudformation-role" from https://skillstore.io/skills/daisuke897-assume-cloudformation-role.md and its manifest at https://skillstore.io/api/skills/daisuke897-assume-cloudformation-role/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "assume-cloudformation-role". Assume the CloudFormation write role with the default profile.
Expected outcome:
The assistant presents the STS assume-role command, shows how credentials are extracted, and reminds the user to remove temporary credential files.
Using "assume-cloudformation-role". Prepare credentials before updating my-stack.
Expected outcome:
- Confirms the AWS profile and role ARN.
- Provides the temporary credential setup sequence.
- Suggests verifying caller identity before the stack update.
Using "assume-cloudformation-role". Make the credential setup safer for a shared workstation.
Expected outcome:
The assistant recommends a unique temporary file, restrictive permissions, trap-based cleanup, and process-scoped environment variables.
Security Audit
Criticalv11 • 7/9/2026 Open versioned report
The skill intentionally runs AWS CLI and jq commands to assume a CloudFormation write role and export temporary AWS credential variables. Most backtick detections are markdown formatting false positives, but the shell command substitution, environment variable export, shared /tmp credential file, and AWS credential directory references are real security concerns that require safer handling.
1
Files scanned
80
Lines analyzed
17
Review items
0
False positives ignored
Confirmed security concerns (1)
Critical
AWS credentials directory
- Specified profile (default: `web-hosting`) configured in `~/.aws/credentials` or `~/.aws/config`
The skill references ~/.aws/credentials as a prerequisite, which is a sensitive credential location. It does not read or exfiltrate the file, but marketplace review should fail closed on direct credential-directory references.
Capability review items (17)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
- Specified profile (default: `web-hosting`) configured in `~/.aws/credentials` or `~/.aws/config`
The skill relies on AWS profiles stored under ~/.aws. This is normal AWS CLI usage, but it references sensitive credential configuration in the home directory.
High
Temp directory access
> /tmp/creds.json
The command writes STS credential output to /tmp/creds.json. A predictable shared temporary file can expose credentials or be targeted by symlink attacks on multi-user systems.
High
Temp directory access
export AWS_SECRET_ACCESS_KEY=$(jq -r '.Credentials.SecretAccessKey' /tmp/creds.json)
The command reads the AWS secret access key from /tmp/creds.json. This confirms sensitive credential material is stored in a predictable temporary file.
High
AWS credential environment variables
export AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' /tmp/creds.json)
The skill exports AWS_ACCESS_KEY_ID into the shell environment. Environment variables can leak to child processes, shell logs, or debugging output.
High
AWS credential environment variables
export AWS_SECRET_ACCESS_KEY=$(jq -r '.Credentials.SecretAccessKey' /tmp/creds.json)
The skill exports AWS_SECRET_ACCESS_KEY into the shell environment. This is sensitive credential material and creates exposure beyond the immediate AWS command.
High
AWS credential environment variables
export AWS_SESSION_TOKEN=$(jq -r '.Credentials.SessionToken' /tmp/creds.json)
The skill exports AWS_SESSION_TOKEN into the shell environment. The temporary token grants AWS permissions until expiration and can leak to child processes.
High
AWS credential environment variables
- `AWS_ACCESS_KEY_ID`
The output section confirms AWS_ACCESS_KEY_ID is set by the workflow. This is intentional but security relevant credential exposure.
High
AWS credential environment variables
- `AWS_SECRET_ACCESS_KEY`
The output section confirms AWS_SECRET_ACCESS_KEY is set by the workflow. This is intentional but high risk because it exposes a secret in the environment.
High
AWS credential environment variables
- `AWS_SESSION_TOKEN`
The output section confirms AWS_SESSION_TOKEN is set by the workflow. This is intentional but sensitive because it grants temporary AWS access.
Medium
Shell command substitution
export AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' /tmp/creds.json)
The example executes jq through shell command substitution to export AWS credentials. It is a legitimate local parsing step but still executes external commands while handling secrets.
Medium
Shell command substitution
export AWS_SECRET_ACCESS_KEY=$(jq -r '.Credentials.SecretAccessKey' /tmp/creds.json)
The example executes jq through shell command substitution to read the secret access key. This is expected for the workflow but increases exposure if shell history, tracing, or process capture is present.
Medium
Shell command substitution
export AWS_SESSION_TOKEN=$(jq -r '.Credentials.SessionToken' /tmp/creds.json)
The example executes jq through shell command substitution to read the session token. This is legitimate but still external command execution over credential material.
Medium
Template literal with command substitution
```bash
The fenced example contains command substitution later in the block. It is documentation rather than code, but the skill instructs users to run the commands, so the pattern is relevant.
Medium
Hidden file access
- Specified profile (default: `web-hosting`) configured in `~/.aws/credentials` or `~/.aws/config`
The skill instructs use of AWS configuration under ~/.aws. This is expected for AWS CLI profile use, but it is still access to sensitive hidden files.
Medium
Temp directory access
export AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' /tmp/creds.json)
The command reads AWS access key material from /tmp/creds.json. The temporary file contains secrets and should not use a predictable shared path.
Medium
Temp directory access
export AWS_SESSION_TOKEN=$(jq -r '.Credentials.SessionToken' /tmp/creds.json)
The command reads the AWS session token from /tmp/creds.json. The workflow depends on a temporary file containing active credentials.
Medium
Temp directory access
rm /tmp/creds.json
The example deletes /tmp/creds.json after parsing, which reduces exposure. The predictable file still exists briefly and cleanup may fail if commands abort.
Risk Factors
⚙️ External commands (15)
📁 Filesystem access (7)
🔑 Env variables (6)
Detected Patterns
AWS credentials directory
Audited by: claude View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/daisuke897-assume-cloudformation-role/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/daisuke897-assume-cloudformation-role?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/daisuke897-assume-cloudformation-role?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/daisuke897-assume-cloudformation-role/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/daisuke897-assume-cloudformation-role.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Daisuke897. (2026). assume-cloudformation-role security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/daisuke897-assume-cloudformation-role/audits/11BibTeX citation
@techreport{daisuke897-daisuke897-assume-cloudformation-role-2026,
author = {Daisuke897},
title = {assume-cloudformation-role security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/daisuke897-assume-cloudformation-role/audits/11},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "assume-cloudformation-role security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
- name: "Daisuke897"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/daisuke897-assume-cloudformation-role/audits/11"
identifiers:
- type: other
value: "skillstore:daisuke897-assume-cloudformation-role:audit:11"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
91
Spec Compliance
What You Can Build
Prepare deployment credentials
Assume a CloudFormation write role before creating or updating a stack from the AWS CLI.
Standardize role setup
Give a team a consistent sequence for obtaining temporary AWS credentials before stack maintenance.
Run controlled stack cleanup
Set temporary credentials before deleting a known CloudFormation stack during maintenance.
Try These Prompts
Assume the default role
Use the assume-cloudformation-role skill with the default profile and role session name. Explain each command before I run it.
Use a custom AWS profile
Use this skill with my AWS CLI profile named staging-admin. Keep the default role session name unless I specify another one.
Prepare for a stack update
Assume the CloudFormation role, then help me confirm the AWS identity before I run an update-stack command.
Harden the credential workflow
Adapt the assume-role workflow to avoid a predictable /tmp credential file and keep credentials scoped to one CloudFormation command.
Best Practices
- Verify the AWS account and caller identity before running stack changes.
- Use the shortest practical credential lifetime and clear environment variables after use.
- Store temporary credential files with restrictive permissions and automatic cleanup.
Avoid
- Do not reuse the hardcoded example role ARN without confirming the target account.
- Do not leave AWS_SECRET_ACCESS_KEY or AWS_SESSION_TOKEN exported after the task finishes.
- Do not write active credentials to predictable shared paths on multi-user systems.
Frequently Asked Questions
Does this skill create or update CloudFormation stacks by itself?
No. It prepares AWS credentials so a user can run CloudFormation commands afterward.
Which AWS permissions are required?
The source profile needs sts:AssumeRole permission for the configured CloudFormation write role.
How long do the temporary credentials last?
The skill notes that temporary credentials typically expire after about one hour.
Can I use a different role ARN?
Yes. The role ARN is an input parameter and should match your AWS account and deployment policy.
Is this safe on a shared machine?
Use caution. The documented example writes credentials to /tmp, so safer temporary file handling is recommended.
Does it require jq?
Yes. The documented workflow uses jq to extract fields from the AWS STS JSON response.
Developer Details
Author
Daisuke897License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/Daisuke897/dotfiles/tree/main/.github/skills/assume-cloudformation-roleRef
7db9b9f06e0ab79c575b58bc48c4d8dc9849f424
Maintenance freshness
7/18/2026
Usage
4 downloads · 188 views
File structure
📄 SKILL.md